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Foreword 

This Technical Specification (TS) has been produced by the 3^^ Generation Partnership Project (3GPP). 

The contents of the present document are subject to continuing work within the TSG and may change following formal 
TSG approval. Should the TSG modify the contents of the present document, it will be re-released by the TSG with an 
identifying change of release date and an increase in version number as follows: 

Version x.y.z 

where: 

X the first digit: 

1 presented to TSG for information; 

2 presented to TSG for approval; 

3 or greater indicates TSG approved document under change control. 

Y the second digit is incremented for all changes of substance, i.e. technical enhancements, corrections, 
updates, etc. 

z the third digit is incremented when editorial only changes have been incorporated in the document. 



Introduction 

The present document defines the application test specification. 

The aim of the present document is to ensure interoperability between an UICC and a terminal independently of the 
respective manufacturer, card issuer or operator. The present document does not define any aspects related to the 
administrative management phase of the UICC. Any internal technical realisation of either the UICC or the Terminal is 
only specified where these are reflected over the interface. 

Application specific details for applications residing on an UICC are specified in the respective application specific 
documents. The logical and physical Characteristics of the UICC Terminal interface is specified in document 
ETSI TS 102 221 [5]. The Universal Subscriber Identity Module (USIM)-appHcation for 3G teleconmiunication 
networks is specified in document TS 31.102 [4]. 
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1 Scope 

The present document provides the UICC -Terminal Interface Conformance Test Specification between a 2G, 3G or 3G 
E-UTRAN terminal and the USIM (Universal Subscriber Identity Module) as an application on the UICC and the 
Terminal for a 2G, 3G or 3G E-UTRAN network operation: 

- the default setting of the USIM; 

- the applicability of each test case; 

- the test configurations; 

- the conformance requirement and reference to the core specifications; 

- the test purposes; and 

- a brief description of the test procedure and the specific acceptance criteria. 

For the avoidance of doubt, references to clauses of ETSI TS 102 221 [5] include all the subclauses of that clause, 
unless specifically mentioned. 

ETSI TS 102 221 [5] contains material that is outside of the scope of 3GPP requirements. A 3GPP ME may support 
functionality that is not required by 3GPP, but the requirements to do so are outside of the scope of 3GPP. Thus the 
present document does not contain tests for features defined in ETSI TS 102 221 [5] which are out of scope of 3GPP. 



2 References 

The following documents contain provisions which, through reference in this text, constitute provisions of the present 
document. 

• References are either specific (identified by date of publication, edition number, version number, etc.) or 
non-specific. 

• For a specific reference, subsequent revisions do not apply. 

• For a non-specific reference, the latest version in same release as the implementation release of the terminal 
under test applies. 

[1] Void 

[2] Void 

[3] 3GPP TS 23.038: "Alphabets and language-specific information". 

[4] 3GPP TS 3 1 . 102: "Characteristics of the USIM appHcation" . 

[5] If the device under test is a 

• R99 ME: ETSI TS 102 221 v3.18.0: "UICC-Terminal interface; Physical and logical 

characteristics", 

• Rel-4 ME: ETSI TS 102 221 v4.16.0: "UICC-Terminal interface; Physical and logical 

characteristics", 

• Rel-5 ME: ETSI TS 102 221 vS.lO.O: "UICC-Terminal interface; Physical and logical 

characteristics", 

• Rel-6 ME: ETSI TS 102 221 v6.15.0: "UICC-Terminal interface; Physical and logical 

characteristics", 

• Rel-7 ME: ETSI TS 102 221 v7.17.0: "UICC-Terminal interface; Physical and logical 

characteristics", 

• Rel-8 ME: ETSI TS 102 221 v8.4.0: "UICC-Terminal interface; Physical and logical 

characteristics", 

• Rel-9 ME: ETSI TS 102 221 v9.0.0: "UICC-Terminal interface; Physical and logical 

characteristics". 
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[27] 3GPP TS 33.401 : "3GPP System Architecture Evolution (SAE); Security architecture". 
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[29] 3GPP TS 36.508: "Evolved Universal Terrestrial Radio Access (E-UTRA) and Evolved Packet 

Core (EPC); Common test environments for User Equipment (UE) conformance testing" 

[30] 3GPP TS 36.523-2 " Evolved Universal Terrestrial Radio Access (E-UTRA) and Evolved Packet 

Core (EPC);User Equipment (UE) conformance specification;Part 2: Implementation 
Conformance Statement (ICS) proforma specification" 

[31] 3GPP TS 23.122: "Non- Access-Stratum functions related to Mobile Station (MS) in idle mode". 

[32] 3GPP TS 31.103: "Characteristics of the IP Multimedia Services Identity Module (ISIM) 

application". 

[33] 3GPP TS 34.229-1: "Internet Protocol (IP) multimedia call control protocol based on Session 

Initiation Protocol (SIP) and Session Description Protocol (SDP); User Equipment (UE) 
conformance specification; Part 1: Protocol conformance specification". 



ETSI 



3GPP TS 31.121 version 10.2.1 Release 10 



20 



ETSI TS 131 121 VI 0.2.1 (2011-11) 



3 Definitions, symbols, abbreviations and coding 
3.1 Definitions 

For the purposes of the present document, the following terms and definitions apply. 

Application DF (ADF): entry point to an application 

access conditions: set of security attributes associated with a file 

access technology: Radio Access Technology of the Terminal (e.g. E-UTRAN, UTRAN or GSM) 

application: consists of a set of security mechanisms, files, data and protocols (excluding transmission protocols) 

application protocol: set of procedures required by the application 

card session: link between the card and the external world starting with the ATR and ending with a subsequent reset or 
a deactivation of the card 

current directory: latest MF or DF or ADF selected 
current EF: latest EF selected 

data object: information coded as TLV objects, i.e. consisting of a Tag, a Length and a Value part 

Dedicated File (DF): file containing access conditions and, optionally, Elementary Files (Efs) or other Dedicated Files 
(DFs) 

directory: general term for MF, DF and ADF 

Elementary File (EF): file containing access conditions and data and no other files 

file: directory or an organised set of bytes or records in the UICC 

file identifier: 2 bytes which address a file in the UICC 

function: function contains a command and a response pair 

GSM session: that part of the card session dedicated to the GSM operation 

Master File (MF): unique mandatory file containing access conditions and optionally DFs and/or Efs 

MMS Relay/Server: MMS -specific network entity/application that is under the control of the MMS service provider 

NOTE: An MMS Relay/Server transfers messages, provides operations of the MMS that are specific or required 
by the mobile environment and provides (temporary and/or persistent) storage services to the MMS 

MMS User Agent: application residing on a UE or an external device that performs MMS -specific operations on a 
user's behalf 

normal USIM operation: relating to general, PIN related, LTE and/or 3G and/or GSM security and subscription 
related procedures 

record: string of bytes within an EF handled as a single entity 
record number: number, which identifies a record within an EF 
record pointer: pointer, which addresses one record in an EF 

terminal: device into which a UICC can be inserted and which is capable of providing access to 3GPP system services 
to users, either alone or in conjunction with a UICC 
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User Equipment (UE): terminal with a UICC inserted with one or several Universal Subscriber Identity Module(s) 
(USIM) available for access either E-UTRANor UTRAN or GERAN or any combination. 

USIM session: USIM session is a selectable application session for a USIM application 

3.2 Symbols 

For the purposes of the present document, the following symbols apply: 

bx Bit X of byte (leftmost bit is MSB) 

Bn Byte No. n 

3.3 Abbreviations 

For the purposes of the present document, the following abbreviations apply: 



2G 


2"^ Generation 


3G 


3^^ Generation 


3GPP 


3^^ Generation Partnership Project 


ACC 


Access Class 


ACL 


APN Control List 


ACM 


Accumulated Call Meter 


ACMmax 


ACM maximal value 


ACT 


Access Technology 


ADF 


Application Dedicated File 


AoC 


Advice of Charge 


AoCC 


Advice of Charge Charging 


APN 


Access Point Name 


ASME 


Access Security Management Entity 


ATR 


Answer To Reset 


BCCH 


Broadcast Control Channel 


BCD 


Binary Coded Decimal 


BDN 


Barred Dialling Number 


CCI 


Capability / Configuration! Identifier 


CCI2 


Capability / Configuration(2) Identifier 


CCM 


Current Call Meter 


CK 


Cinher kev 


CN 


Core Network 


cs 


Circuit switched 


CSG 


Closed Subscriber Group 


DF 


Dedicated File 


EPC 


Evolved Packet Core 


E-USS 


Evolved UMTS System Simulator 


E-UTRA 


Evolved UTRA 


EE 


Elementary File 


eFDD 


evolved Frequency Division Duplex 


EMM 


EPS Mobility Management 


EMMI 


Electrical Man Machine Interface 


EPS 


Evolved Packet System 


eTDD 


evolved Time Division Duplex 


Ext n 


Extension n 


FDD 


Frequency Division Duplex 


EDN 


Fixed Dialling Number 


FPLMN 


Forbidden PLMN 


GSM 


Global System for Mobile communications 


HNB 


Home NodeB 


HeNB 


Home eNodeB 


HPLMN 


Home PLMN 


ICC 


Integrated Circuit Card 


ID 


Identifier 
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lEC 


International Electrotechnical Conunission 


IK 


Integrity key 


IMSI 


International Mobile Subscriber Identity 


ISO 


International Organization for Standardization 


KSI 


Key Set Identifier 


LAC 


Location Area Code 


LAI 


Location Area Information 


LSB 


Least Significant Bit 


MCC 


Mobile Country Code 


MF 


Master File 


MM 


Multimedia Message 


MMI 


Man Machine Interface 


MMS 


Multimedia Messaging Service 


MNC 


Mobile Network Code 


MS 


Mobile Station 


MSB 


Most Significant Bit 


NAS 


Non Access Stratum 


NPI 


Numbering Plan Identifier 


OFM 


Operational Feature Monitor 


OSI 


Open System Interconnection 


PI 


Parameter 1 


P2 


Parameter 2 


P3 


Parameter 3 


PIN 


Personal Identification Number 


PLMN 


Public Land Mobile Network 


PS 


Packet switched 


RACK 


Random Access Channel 


RFU 


Reserved for Future Use 


RRC 


Radio Resource Control 


SFI 


Short File Identifier 


SM 


Short Message 


SMS 


Short Message Service 


SS 


System Simulator (GSM) 


TDD 


Time Division Duplex 


TE 


Terminal Equipment 


TLV 


Tag Length Value 


TMSI 


Temporary Mobile Subscriber Identity 


TON 


Type Of Number 


UE 


User Equipment 


USIM 


Universal Subscriber Identity Module 


USS 


UMTS System Simulator 


UTRA 


Universal Terrestrial Radio Access 


UTRAN 


UMTS Terrestrial Radio Access Network 


VPLMN 


Visitor PLMN 



3.4 Coding Conventions 

For the purposes of the present document, the following coding conventions apply: 

All lengths are presented in bytes, unless otherwise stated. Each byte B is represented by eight bits b8 to bl, where b8 is 
the most significant bit (MSB) and bl is the least significant bit (LSB). In each representation, the leftmost bit is the 
MSB. 

In the UICC, all bytes specified as RFU shall be set to '00' and all bits specifies as RFU shall be set to '0'. If the GSM 
and/or USIM application exists on a UICC or is built on a generic telecommunications card, then other values may 
apply for the non- GSM or non-USIM applications. The values will be defined in the appropriate specifications for such 
cards and applications. These bytes and bits shall not be interpreted by a Terminal in a GSM or 3G session. 

The coding of all data objects in the present document is according to ETSI TS 102 221 [5]. All data objects are BER- 
TLV except if otherwise defined. 
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3.5 Generic procedures for E-UTRAN/UTRAN/GERAN/IMS 

If a test case contains the statement "This test appHes to Terminals accessing E-UTRAN", the procedures defined in 
TS 36.508 [29] shall be the basis for all performed procedures during the test. The procedures in subclause 4.5 describe 
the default behaviour of a conformant UE regarding the specified protocols to be used for E-UTRAN and the required 
procedures from the NAS. 

If a test case contains the statement "This test applies to Terminals accessing UTRAN", the procedures defined in 
TS 34.108 [21], subclause 7.2 shall be the basis for all performed procedures during the test. The procedures in 
subclause 7 describe the default behaviour of a conformant UE regarding the specified protocols to be used for UTRAN 
and the required procedures from the NAS. 

If a test case contains the statement "This test applies to Terminals accessing GERAN", the procedures defined in 
TS 51.010-1 [22], subclause 10 shall be the basis for all performed procedures during the test. The procedures in 
subclause 10 describe the default behaviour of a conformant UE regarding the specified protocols to be used for 
GERAN and the required procedures from the NAS. 

3GPP TS 34.229-1 [33], Annex C describes the generic test procedures for IMS. 

3.6 Applicability 

3.6.1 Applicability of the present document 

The present document applies to a terminal equipment supporting the USIM. 

3.6.2 Applicability to terminal equipment 

The applicability to terminal equipment supporting the USIM is specified in table B.l, unless otherwise specified in the 
specific clause. 

3.6.3 Applicability of the individual tests 

Table B.l lists the optional, conditional or mandatory features for which the supplier of the implementation states the 
support. As pre-condition the supplier of the implementation shall state the support of possible options in table A. 1 . 

The "Release XY ME" columns shows the status of the entries as follows: 

The following notations, defined in ISO/IEC 9646-7 [19], are used for the status colunm: 

M mandatory - the capability is required to be supported. 

O optional - the capability may be supported or not. 

N/A not applicable - in the given context, it is impossible to use the capability. 

X prohibited (excluded) - there is a requirement not to use this capability in the given context. 

O.i qualified optional - for mutually exclusive or selectable options from a set. "i" is an integer which 

identifies an unique group of related optional items and the logic of their selection which is 
defined immediately following the table. 

Ci conditional - the requirement on the capability ("M", "O", "X" or "N/A") depends on the support 

of other optional or conditional items, "i" is an integer identifying an unique conditional status 
expression which is defined immediately following the table. For nested conditional expressions, 
the syntax "IF . . . THEN (IF . . . THEN . . . ELSE. . .) ELSE ..." shall be used to avoid ambiguities. 

The "Additional test case execution recommendation" column shows the status of the entries as follows: 

A applicable - the test is applicable according to the corresponding entry in the "Rxx ME" colunm 
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R redundant - the test has to be considered as redundant when the corresponding E-UTRAN/EPC 

related test of the present document has been validated and successfully executed. In that case the 
requirement may be verified by means of the E-UTRAN/EPC functionality only. 

AERi Additional test case Execution Recommendation - with respect to the above listed definitions of 

("A") and ("R") the test is applicable ("A") or redundant ("R") depending on the support of other 
optional or conditional items, "i" is an integer identifying a unique conditional status expression 
which is defined inmiediately following the table. For nested conditional expressions, the syntax 
"IF ... THEN (IF ... THEN ... ELSE...) ELSE ..." shall be used to avoid ambiguities. 

References to items 

For each possible item answer (answer in the support column) there exists a unique reference, used, for example, in the 
conditional expressions. It is defined as the table identifier, followed by a solidus character "/", followed by the item 
number in the table. If there is more than one support column in a table, the colunms shall be discriminated by letters 
(a, b, etc.), respectively. 

EXAMPLE: A. 1/4 is the reference to the answer of item 4 in table A. 1 . 

3.7 Table of optional features 

Support of several features is optional or release dependent for the terminal equipment. However, if an ME states 
conformance with a specific 3 GPP release, it is mandatory for the ME to support all mandatory functions of that release, 
as stated in table A.l. 

The supplier of the implementation shall state the support of possible options in table A.l. 
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Table A.1 : Options 



lid II 

1 


Ontinn 

Support of CS 





Qi mnnrt 
ouppv^i I 


IWInoinr^nir^ 
ivii idiii/i no 

CS 


2 


Support of a feature requiring PIN2 
entry (such as e.g. AoC or FDN) 







0_PIN2_ENTRY_FEAT 


Q 
O 


ouppori OT u 1 nAiN access 


UUUl 




O 1 ITDAM 


A 


ouppori OT vjtnMiN access 






n P R A M 


O 


oupport OT rixea uiaiiing iNiumoers 


r\ 
U 




U rUIN 


6 


Support of Advice of Charge 
unarging 







0_AoCC 


"7 
/ 


ouppori OT nigner prioriiy r liviin 
selector with Access Technology 

ooiviuo ^11 1 i|jic;i 1 lUi ildliui 1 lo UjJliui icii 

in Rel-6 and onwards) 


pnnQ 
UUUo 




U_nr LIVIINIWAU 1 


Q 
O 


OUppUl I Ul lUUCll |JI lUI IC7UUUr\ 


OUUt- 




O 1 nral PR 
\J i-UUcli r D 


9 


Support of global phonebook 


C004 




Global PB 


\ u 


ouppori OT sToring receivea uiass 

C Ol lUI L lvlC700Ciy C70 III LI IC7 I^OIIVI 






u_oTore_rieceivea_oivio 


1 1 


^1 innnrt nf K/IK/I^ 

OU|J|JUI L Ul iVIiViO 


n 




v_y IVIIVIO 


12 


Support of usage of MMS related 

UdLa olUitJU Uil lilt? UOIIVI 


C005 




0_MMS_USIM_DATA 


1 o 


Qi innnrtfiH nf i incQlQptfiH i icf^r 

OU|J|JUl lOU Ul UMoCICUlCU uooi 

KyiKyif^ mnnppti\/it\/ narpmptpr^ 

IVIIVIO UUI II lOUll V 1 ly l^dl Cll 1 IC7LC7I o 






O NO IRFR MM<^ r.ONF <^FI FP. 

W INV./ LiOL- ri IVIIVIO V.yV./l>in Ot-l—I^O 


14 


f^iinnnrt nf MMR nntifiratinn 
storage on the USIM 







O MMS NOTIF STORAGE 


15 


Support of ACL 







ACL 


16 


Sunnnrt nf SDN 







SDN 


17 


Support of numerical entry of 
PLMN codes in EF PLMNwACT 







0_EFPLMNwACT_numerical entry 


18 


Terminal does support speech call 







Speech Calls 


19 


Terminal support PIN MMI strings 







0_PIN_MMI_Strings 


on 


1 erminai ooes suppori eruu 


\j 




pc_e r u u 


21 


Terminal does support eTDD 







pc_eTDD 


22 


Terminal does support CSG list 
handling 







pc_Allowed_CSG_list 


23 


Terminal supports SM-over-IP- 
receiver 







pc_SM-over-IP receiver 


24 


Terminal supports reading SMS' 
stored in EF SMS on the USIM if 
USIM and ISIM are present 







pc_USIM_EF_SMS_reading_support_if_USI 
MJSIM both present 


25 


Terminal supports reading SMS' 
stored in EF SMS on the ISIM if 
USIM and ISIM are present 







pc_ISIM_EF_SMS_reading_support_if_USIM 
JSIM both present 


C001 If terminal is 3G terminal then M else N/A 
C002 If terminal is 2G terminal then M else 

COOS If Higher priority PLMN selector with Access Technology service is implemented according to Rel-6 or 
later then else M 

C004 If terminal is implemented according to Rel-6 or later then M, else 

C005 If terminal is implemented according to R99 then N/A else if terminal is implemented according to Rel- 
4 then else M 
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3.8 Applicability table 



Table B.1 : Applicability of tests 



Item 


Description 


Tested 


Test 


R99 ME 


Rel-4 


Rel-5 


Rel-6 


Rel-7 


Rel-8 


Rel-9 


ReMO 


Network 


Sup 


Additional 






feature 


sequence(s 




ME 


ME 


ME 


ME 


ME 


ME 


ME 


Depende 


port 


test case 






defined 


) 


















ncy 




execution 






in 
























recommenda 






Release 
























tion 
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Item 


Description 


Tested 
feature 
defined 
in 

Release 


Test 
sequence(s 
) 


R99 ME 


Rel-4 
ME 


Rel-5 
ME 


Rel-6 
ME 


Rel-7 
ME 


Rel-8 
ME 


Rel-9 
ME 


Rel-10 
ME 


Network 
Depende 
ncy 


Sup 
port 


Additional 
test case 
execution 
recommenda 
tion 


1 


uc luol III iiuciLiui 1 uy 
Short IMSI 


RQQ 


O. 1 . 1 


IVI 


IVI 


IVI 


K/l 

IVI 


IVI 


IVI 


Kyi 

IVI 


IVI 


1 IMT<^ 

UIVI 1 o 

System 
Simulator 
or System 
Simulator 
only 








uc luui luiiuaiiui 1 uy 
short IMSI using 2 
digit MNC 


RQQ 


O. 1 .c. 


IVI 


IVI 


IVI 


IVI 


IVI 


IVI 


Kyi 

IVI 


IVI 


1 IK/ITQ 
UIVI 1 o 

System 
Simulator 
or System 
Simulator 
only 






O 


1 IF iHontif ir'dti/^n h\/ 

uc luui III 1 ludiiui 1 uy 
"short" IMSI 


PQQ 


O. 1 .o 


















U IVI 1 o 

System 
Simulator 
or System 
Simulator 
only 






A 
4 


uti luui nil ludiiui 1 uy 
"long" IMSI 


RQQ 


O. 1 .H- 


















1 iKyiT<^ 

LJIVI 1 O 

System 
Simulator 
or System 
Simulator 
only 









uc iuc;iiiiiiuciiiuii uy 
long IMSI, TMSI 
updating after key set 
identifier assignment 


RQQ 


O. 1 .o 


















1 iNyiT^ 

U IVI 1 o 

System 
Simulator 
or System 

Qimi ilatnr 

Oil 1 lUlCllUI 

only 






6 


UE identification by 
short IMSI when 
accessing E- 
UTRAN/EPC 


Rel-8 


5.1.6 


N/A 


N/A 


N/A 


N/A 


N/A 


C027 


C027 


C027 


E-UTRAN 

System 
Simulator 
only 






7 


UE identification by 
short IMSI using 2 
digit MNC when 
accessing E- 
UTRAN/EPC 


Rel-8 


5.1.7 


N/A 


N/A 


N/A 


N/A 


N/A 


C027 


C027 


C027 


E-UTRAN 
System 
Simulator 
only 
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Item 


Description 


Tested 


Test 


R99 IVIE 


Rel-4 


Rel-5 


Rel-6 


Rel-7 


Rel-8 


Rel-9 


Rel-10 


Network 


Sup 


Additional 






feature 

II IC7U 


sequence(s 
) 




ME 


ME 


ME 


ME 


ME 


ME 


ME 


Depende 

1 1 


port 


test case 

AYPPiitinn 

CJvCl^U ll\ii 1 






in 






















1 C\«wl 1 II 1 Id lUCl 






























tinn 
ii\ii 1 


8 


UE identification after 
changed IMSI with 
service "EMM 


Rel-8 


5.1.8 


N/A 


N/A 


N/A 


N/A 


N/A 


C027 


C027 


C027 


E-UTRAN 
System 
Simulator 








Information" not 






















only 








a\/ai|ah|p 
ClVClllClL/ICx 


























9 


UE identification by 
GUT! when using 
USIM with service 
"EMM Information" 

1 dvciiiciuic; 


Rel-8 


5.1.9 


N/A 


N/A 


N/A 


N/A 


N/A 


C027 


C027 


C027 


E-UTRAN 
System 
Simulator 
only 






10 


UE identification by 
GUT! when using 
USIM with service 
"EMM Information" 
available 


Rel-8 


5.1.10 


N/A 


N/A 


N/A 


N/A 


N/A 


C027 


C027 


C027 


E-UTRAN 
System 
Simulator 
only 






1 1 


MUUcoo OUilliUI 

information handling 


RQQ 




















1 \MT^ 

yjlvl I <D 

System 
Simulator 
or System 

^imi ilatnr 

oil 1 1 U ICllUI 

only 






12 


Access Control 
information handling 
for E-UTRAN/EPC 


Rel-8 


5.2.2 


N/A 


N/A 


N/A 


N/A 


N/A 


C027 


C027 


C027 


E-UTRAN 
System 
Simulator 
only 






13 


Entry of PIN 


R99 


6.1.1 


M 


M 


M 


M 


M 


M 


M 


M 


No 






14 


Change of PIN 


R99 


6.1.2 


M 


M 


M 


M 


M 


M 


M 


M 


No 






15 


Unblock PIN 


R99 


6.1.3 


C025 


C025 


C02S 


C02S 


C02S 


C025 


C02S 


C02S 


No 






16 


Entry of PIN2 


R99 


6.1.4 


COOS 


COOS 


COOS 


COOS 


COOS 


COOS 


COOS 


COOS 


No 






17 


Change of PIN2 


R99 


6.1.5 


C005 


COOS 


COOS 


COOS 


COOS 


COOS 


COOS 


COOS 


No 






18 


Unblock PIN2 


R99 


6.1.6 


C026 


C026 


C026 


C026 


C026 


C026 


C026 


C026 


No 






19 


Replacement of PIN 


R99 


6.1.7 


M 


M 


M 


M 


M 


M 


M 


M 


No 






20 


Change of Universal 
PIN 


R99 


6.1.8 


M 


M 


M 


M 


M 


M 


M 


M 


No 






21 


Unblock Univesal 
PIN 


R99 


6.1.9 


M 


M 


M 


M 


M 


M 


M 


M 


No 






22 


Entry of PIN on multi- 
verification capable 
UlCCs 


Rel-4 


6.1.10 


N/A 


M 


M 


M 


M 


M 


M 


M 


No 
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Item 


Description 


Tested 
feature 

Hpf inpH 

VJ^l II I^VJ 

in 

Release 


Test 
sequence(s 

\ 
} 


R99 ME 


Rel-4 
ME 


Rel-5 
ME 


Rel-6 
ME 


Rel-7 
ME 


Rel-8 
ME 


Rel-9 
ME 


Rel-10 
ME 


Network 
Depende 
ncy 


Sup 
port 
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test case 
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Rel-4 
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N/A 
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Replacement of PIN 
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Simulator 
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ME 
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pnn7 


pnn7 


pnn7 


1 iKyiT^^ 

UIVI 1 o 

System 
Simulator 
or System 
Simulator 
only 






04 


IVIaXII 1 lUl 1 1 1 rc;L|Uc;i luy 

of ACM updating 


RQQ 


R 4 9 


ouuo 


pnoft 


pnoft 


pnoft 


POOR 


pnoft 


pnoft 


pnoft 


1 iKyiTQ 

UIVII o 

System 
Simulator 
or System 
Simulator 
only 






OO 


Ocill lUi M IIMdlUU VVi loll 

ACM greater than 
ACMmax 


RQQ 


fi 4 
D.H-.O 


ouuo 


pnnft 
ouuo 


pnnft 
ouuo 


pnnft 
ouuo 


pnnft 
ouuo 


pnnft 
ouuo 


pnnft 
ouuo 


pnnft 
ouuo 


1 iKyiT<^ 

U IVI 1 o 

System 
Simulator 
or System 
Simulator 
only 






OD 


nUb|JUiloc UUUUo Ul 

increase command of 
ACM 


RQQ 


fi 4 4 


ouuo 


pnnft 
ouuo 


pnnft 
ouuo 


pnnft 
ouuo 


pnnft 
ouuo 


pnnft 
ouuo 


pnnft 
ouuo 


pnnft 
ouuo 


1 iKyiT<^ 

UIVI 1 o 

System 
Simulator 
or System 
Simulator 
only 






Of 


AHHinn FPI N/IM tn tho 
MUUIIiy nrLIVIIN lU lilt? 

forbidden PLMN list 


RQQ 


7 11 

/.I.I 


Kyi 

IVI 


IVI 


Kyi 

IVI 


Kyi 

IVI 


Kyi 

IVI 


Kyi 

IVI 


Kyi 

IVI 


Kyi 

IVI 


1 iKyiT^ 

U IVI 1 o 

System 
Simulator 
or System 
Simulator 
only 






OO 


U C U|JUcllli ly 

forbidden PLMNs 


RQQ 


7 19 
/ . 1 


IVI 


IVI 


Kyi 

IVI 


Kyi 

IVI 


Kyi 

IVI 


Kyi 

IVI 


Kyi 

IVI 


Kyi 

IVI 


1 iKyiT*^ 

UIVI 1 o 

System 
Simulator 
or System 
Simulator 
only 






oy 


1 IF Holotinn 

\J I— UCICLIi 

forbidden PLMNs 


RQQ 


7 1'^ 


K/l 

IVI 


IVI 


Kyi 

IVI 


Kyi 

IVI 


Kyi 

IVI 


Kyi 

IVI 


Kyi 

IVI 


Kyi 

IVI 


I iNyiT^ 

\J IVI 1 o 

System 
Simulator 
or System 
Simulator 
only 
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Item 


Description 


Tested 
feature 
defined 
in 

Release 


Test 
sequence(s 
) 


R99 ME 


Rel-4 
ME 


Rel-5 
ME 


Rel-6 
ME 


Rel-7 
ME 


Rel-8 
ME 


Rel-9 
ME 


Rel-10 
ME 


Network 
Depende 
ncy 


Sup 
port 


Additional 
test case 
execution 

rponiTiiinpnrlfl 

1 www! lllllwllvlCl 

tion 


40 


Adding FPLMN to the 
forbidden PLMN list 

VVI lOI 1 ClUUC^OOll 1^ 1 — 

UTRAN 


Rel-8 


7.1.4 


N/A 


N/A 


N/A 


N/A 


N/A 


C027 


C027 


C027 


E-UTRAN 
System 

Qirni llfltnr 
Oil 1 lUiClLvyi 

only 






41 


UE updating 
forbidden PLMNs 

\/\/hfin appficcinn F- 
vvi loi 1 ciLrLrCooii 1^ 

UTRAN 


Rel-8 


7.1.5 


N/A 


N/A 


N/A 


N/A 


N/A 


C027 


C027 


C027 


E-UTRAN 
System 

Qimi ilatnr 
oil 1 lUlCllUI 

only 






42 


UE deleting 

fnrhirlrlpn PI ^ylNc; 

when accessing E- 
UTRAN 


Rel-8 


7.1.6 


N/A 


N/A 


N/A 


N/A 


N/A 


C027 


C027 


C027 


E-UTRAN 

oy oici 1 1 

Simulator 
only 






43 


UE updating the User 
controlled PLMN 
selector list 


R99 


7.2.1 


C022 


C022 


C022 


C022 


C022 


C022 


C022 


C022 


No 








\J\— 1 cUUy 1 lloli ly Lilc; 

priority order of the 
User controlled 
PLMN selector list 
with the same access 
technology 


RQQ 


7 P P 


Kyi 

IVI 


IVI 


Kyi 

IVI 


Kyi 

IVI 


Kyi 

IVI 


Kyi 

IVI 


Kyi 

IVI 


Kyi 

IVI 


1 iKyiT<^ 

UIVI 1 o 

System 
Simulator 
or System 
Simulator 
only 






40 


1 IF ror'/^/^nioin/^ tho 

uc it^uuyi iibii ly iiic 
priority order of the 
User controlled 
PLMN selector list 

1 iQinn an Af^T 

UOll ly Cll 1 rWj \ 

preference 


RQQ 


1 .C..O 








PnnQ 


PnnQ 


PnnQ 


PnnQ 


PnnQ 


1 iKyiTQ 

UIVII o 

System 
Simulator 
and 

oy oici 1 1 

Simulator 






46 


User controlled 
PLMN selector 
handling for E- 
UTRAN 


Rel-8 


7.2.5 


N/A 


N/A 


N/A 


N/A 


N/A 


C022 
AND 
C027 


C022 
AND 
C027 


C022 
AND 
C027 


No 






47 


UE recognising the 
nrioritv ordpr of thp 
User controlled 
PLMN selector list 
using an ACT 
preference - 
UTRAN/E-UTRAN 


Rel-8 


7.2.6 


N/A 


N/A 


N/A 


N/A 


N/A 


C022 
AND 
C027 


C022 
AND 
C027 


C022 
AND 
C027 


E-UTRAN 
and 
UMTS 
System 
Simulator 
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Item 


Description 


Tested 
feature 
defined 
in 

Release 


Test 
sequence(s 
) 


R99 ME 


Rel-4 
ME 


Rel-5 
ME 


Rel-6 
ME 


Rel-7 
ME 


Rel-8 
ME 


Rel-9 
ME 


Rel-10 
ME 


Network 
Depende 
ncy 


Sup 
port 


Additional 
test case 
execution 
recommenda 
tion 


48 


UE recognising the 

piiuiiiy UlUcI Ul U Ic 

User controlled 
PLMN selector list 
using an ACT 
preference - GSM/E- 
UTRAN 


Rel-8 


7.2.7 


N/A 


N/A 


N/A 


N/A 


N/A 


C022 

AMD 

C027 


C022 

AMD 

C027 


C022 

AMD 

C027 


E-UTRAN 

dl iU 

System 
Simulator 






AO 


uc ruuuyi iibii ly uic 
priority order of the 
Operator controlled 
PLMN selector list 




7 1 


Ivl 


Ivl 


^y| 

Ivl 


^y| 

Ivl 


Ivl 


KA 
Ivl 


KA 
Ivl 


KA 
Ivl 


UIVI 1 o 

System 
Simulator 
or System 
Simulator 
only 






50 


UE recognising the 

pilUlliy UlUcl Ul lilc 

User controlled 
PLMN selector over 
the Operator 
controlled PLMN 
selector list 


R99 


7.3.2 


M 


M 


M 


M 


M 


M 


M 


M 


UMTS 

Oyblclll 

Simulator 
or System 
Simulator 
only 






1 


uc luuuyi iibii ly uiu 
priority order of the 
Operator controlled 
PLMN selector list 
when accessing E- 
UTRAN 




7 

/ .o.o 


M/A 


M/A 


M/A 


M/A 


M/A 








F-l ITRAM 

System 
Simulator 
only 






52 


UE recognising the 
priority order of the 

1 Icor r'/^ntr/^II^H 
Ubcl UUlUlUiicJU 

PLMN selector over 
the Operator 
controlled PLMN 
selector list - E- 
UTRAN 


Rel-8 


7.3.4 


N/A 


N/A 


N/A 


N/A 


N/A 


C027 


C027 


C027 


E-UTRAN 
System 

OllilUlalUr 

only 






\J\J 


UE recoanisina the 
search period of the 
Higher priority PLMN 


R99 


7.4.1 


C010 


C010 


C010 


C010 


C010 


C010 


C010 


C010 


UMTS 
System 
Simulator 
or System 
Simulator 
only 
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Item 


Description 


Tested 


Test 


R99 ME 


Rel-4 


Rel-5 


Rel-6 


Rel-7 


Rel-8 


Rel-9 


Rel-10 


Network 


Sup 


Additional 






feature 
defined 
in 


sequence(s 
) 




ME 


ME 


ME 


ME 


ME 


ME 


ME 


Depende 
ncy 


port 


test case 
execution 
recommenda 






Release 
























tion 


OH- 


VJIOIVI/UIVI 1 O UUCll 

mode UEs 
recognising the 
search period of the 

Hinhpr nrinritx/ PI ^ylM 
rniuiid LyiivyiiLy nL_iviiM 


RQQ 


7 A 9 


















UIVI 1 o 

System 
Simulator 
and 

oy old 1 1 

Simulator 






55 


UE recognising the 
search period of the 
Higher priority PLIVIN 
- E-UTRAN 


Rel-8 


7.4.3 


N/A 


N/A 


N/A 


N/A 


N/A 


C010 
AND 
C027 


C010 
AND 
C027 


C010 
AND 
C027 


E-UTRAN 
System 
Simulator 
only 






OD 


F-l ITRAM/FPP 

capable UEs 
recognising the 
search period of the 
Higher priority PLMN 
- GSM/E-UTRAN 




7 A A 


M/A 


M/A 


M/A 


M/A 


M/A 


pnn9 
ouuo 

AND 

C027 


pnn9 
ouuo 

AND 

C027 


pnn9 
ouuo 

AND 

C027 


F-l ITRAM 

and 
System 
Simulator 






Of 


F-l ITRAM/FPP 

capable UEs 
recognising the 

cpprph nprinrl nf thp 

Higher priority PLMN 
- UTRAN/E-UTRAN 


Rpl-ft 
rici o 


7 A^ 


M/A 


M/A 


M/A 


M/A 


M/A 


pm 1 
AND 
C027 


pm 1 
AND 
C027 


pm 1 
AND 
C027 


F-l ITRAM 

and 
UMTS 

^\/Qtpm 
oy oici 1 1 

Simulator 






58 


Recognition of a 

nrpx/ini iqIv phpnnpH 
C7 V ivjuoiy L/i icii i^CLJ 

phonebook 


R99 


8.1.1 


C012 


C012 


C012 


M 


M 


M 


M 


M 


No 






59 


Update of the 

Phnnphnnk 

Synchronisation 
counter (PSC) 


R99 


8.1.2 


C012 


C012 


C012 


M 


M 


M 


M 


M 


No 






60 


Handling of BCD 
number/ SSC content 
extension 


R99 


8.1.3.1 


N/A 


N/A 


C013 


M 


M 


M 


M 


M 


No 






61 


Phonebook selection 


R99 


8.1.4 


N/A 


N/A 


C014 


M 


M 


M 


M 


M 


No 






62 


Local Phonebook 
handling 


R99 


8.1.5 


N/A 


N/A 


C012 


M 


M 


M 


M 


M 


No 






Do 


Pnrropt ctnrano nf a 

SM on the USIM 


RQQ 


ft P 1 




pni R 












p.m R 


1 ]KAT^ 

KJivl 1 O 

System 
Simulator 
or System 
Simulator 
only 




AFRDD'^ 
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Item 


Description 


Tested 
feature 
defined 
in 

Release 


Test 
sequence(s 
) 


R99 ME 


Rel-4 
ME 


Rel-5 
ME 


Rel-6 
ME 


Rel-7 
ME 


Rel-8 
ME 


Rel-9 
ME 


Rel-10 
ME 


Network 
Depende 
ncy 


Sup 
port 


Additional 
test case 
execution 
recommenda 
tion 


OH- 


OUiicUl lodUlliy Ul d. 

SM on the USIM 


RQQ 


ft p p 


\ \j 




pm R 


pm ^ 


pm R 


pm R 


pm R 


pm R 


1 IMT<^ 

UIVI 1 o 

System 
Simulator 
or System 
Simulator 
only 




AFRDDJ. 


DO 


oivi iiitJiiiuiy udpauiiy 
exceeded handling 


RQQ 


ft 9 


pni R 
\ o 


pni R 


pni R 


pni R 


pm ^ 


pm ^ 


pm ^ 


pm ^ 


UIVI 1 o 

System 
Simulator 

Simulator 
only 






66 


Correct storage of an 

nn thp 1 linn 

OIVI Ul 1 U Iv? UIOO 


Rel-7 


8.2.4.A 










C032 


C032 


C032 


C032 


UMTS 

Qx/ctpm 
oy oici 1 1 

Simulator 






67 


Correct storage of an 
SM on the UlCC 


Rel-8 


8.2.4.B 












C031 


C031 


C031 


E-UTRAN 
System 

Qirni ilatnr 

Oil 1 1 U ICllUI 

only 






68 


Correct reading of a 
SIVI on the USIM if 

L^FOIIVI Cll lU lOllvl die 

present 


Rel-7 


8.2.5 










C033 


C033 


C033 


C033 


No 






69 


Correct reading of a 
SM on the ISIM if 
USIM and ISIM are 
present 


Rel-7 


8.2.6 










C034 


C034 


C034 


C034 


No 






/ U 


uc rt;uuyi iibii ly iiic 
priority order of MMS 
Issuer Connectivity 
Parameters 


RpI-J. 


ft 9 1 


M/A 


pni 


pni 7 


Pm 7 


pm 7 


pm 7 


pm 7 


pm 7 


1 iKyiTQ 

UIVI 1 o 

System 
Simulator 
or System 
Simulator 
only 






/ 1 


UE rpcorini«?ino thp 
priority order of MMS 
User Connectivity 
Parameters 


Rel-4 


8.3.2 


N/A 


C016 


C017 


C017 


C017 


C017 


C017 


C017 


UMTS 
System 
Simulator 
or System 
Simulator 
only 
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Item 


Description 


Tested 
feature 
defined 
in 

Release 


Test 
sequence(s 
) 


R99 ME 


Rel-4 
ME 


Rel-5 
ME 


Rel-6 
ME 


Rel-7 
ME 


Rel-8 
ME 


Rel-9 
ME 


Rel-10 
ME 


Network 
Depende 
ncy 


Sup 
port 


Additional 
test case 
execution 
recommenda 
tion 


72 


UE recognising the 

jJilUlliy UIUC7I Ul IvMvIO 

Issuer Connectivity 
Parameters over the 
IVIMS User 
Connectivity 
Parameters 


Rel-4 


8.3.3 


N/A 


C016 


C017 


C017 


C017 


C017 


C017 


C017 


UMTS 

OyoltJI 1 1 

Simulator 
or System 
Simulator 
only 






7Q 
/ O 


UbdyU Ul IVMVIO 

notification 


rici H- 


ft 4 


M/A 


pni ft 

OU 1 o 


pni ft 


pni ft 

OU 1 o 


pm ft 


pni ft 

OU 1 o 


pni ft 

OU 1 o 


pni ft 


1 iK/iTc: 

UIVII o 

System 
Simulator 
or System 
Simulator 
only 






1 4 


UlOO picJbcJllUc? 

detection 


nt?i-o 


O.H- 


M/A 

IM/M 


M/A 

IM/M 


K/l 

IVI 


IVI 


IVI 


IVI 


IVI 


IVI 


1 IK/ITQ 
UiVI 1 o 

System 
Simulator 
or System 

oil 1 1 U ICllUI 

only 




AFROm 
Mcnuu 1 


75 


UlCC presence 
detection when 
connected to E- 
UTRAN/EPC 


Rel-8 


8.5 


N/A 


N/A 


N/A 


N/A 


N/A 


C027 


C027 


C027 


E-UTRAN 
System 
Simulator 
only 






1 D 


ML/Ucoo run 11 wUIILIUI 

List handling for 
terminals supporting 
ACL 


RQQ 


Q 1 1 


M/A 


M/A 


pm Q 

OU 1 


pm Q 

\J\J 1 


pm Q 

\J\J 1 


pm Q 

\J\J 1 


pm Q 


pm Q 


LJIVI 1 o 

System 
Simulator 
or System 
Simulator 
only 




AFRDDP 

MlZriUU^ 




IMclWUiK piUVIUcU 

APN handling for 
terminals supporting 
ACL 


RQQ 


Q 1 9 


M/A 


M/A 


pm Q 
ou 1 y 


pm Q 


pm Q 
ou 1 y 


pm Q 


pm Q 


pm Q 
ou 1 y 


UIVII o 

System 
Simulator 
or System 
Simulator 
only 




AFRnnp 
Mcnuu^ 


78 
/ o 


Appocc Pnint r^nntrnl 

List handling for 
terminals not 
supporting ACL 


RQQ 


Q 1 


M/A 

IN/ 


M/A 

IN/ 


P.DPn 


POPf) 


PDPn 








LJIVI 1 o 

System 
Simulator 
or System 
Simulator 
only 




AFRDDP 
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Itpm 

1 ICI 1 1 




TpctpH 


1 col 


RQQ MF 
ri99 ivi t 


Rel-4 


Rp|-5 


Rp|-6 


Rel-7 


Rp|-8 


Rp|-Q 


Rel-10 






AHHitinnfll 

UlllV/l ICll 






feature 
defined 


sequence(s 
) 




IVIE 


IVIE 


IVIE 


IVIE 


IVIE 


IVIE 


IVIE 


Depende 
ncy 


port 


test case 
execution 






in 






















1 1 II 1 Id lUCl 






























tinn 
ii\ii 1 


79 


Access Point Control 


Rel-8 


9.1.4 


N/A 


N/A 


N/A 


N/A 


N/A 


C029 


C029 


C029 


E-UTRAN 








List handling for 
terminals supporting 
ACL connected to E- 






















System 
Simulator 
only 








l JTRAN/FPO 


























80 


Network provided 
APN handling for 
terminals supporting 
ACL connected to E- 
UTRAN/EPC 


Rel-8 


9.1.5 


N/A 


N/A 


N/A 


N/A 


N/A 


C029 


C029 


C029 


E-UTRAN 
System 
Simulator 
only 






O 1 


MUUcoo rUllll OUIILlUI 

List handling for 
terminals not 
supporting ACL 
connected to E- 
UTRAN/EPC 


nyi o 




M/A 


M/A 


M/A 
Wl r\ 


M/A 


M/A 


ouou 


pn^n 
ouou 


pn^n 
ouou 


F-l ITRAM 

System 
Simulator 
only 






ftp 


Numbers handling 


RQQ 




M/A 
Wl r\ 


M/A 
Wl r\ 


M/A 
Wl r\ 












1 \MT^ 

LJIVI 1 O 

System 
Simulator 
or System 

^imi ilatnr 
oil 1 1 u idiui 

only 






83 


Automatic CSG 
selection in E-UTRA 
with CSG list on 
USIM, success 


Rel-8 


10.1.1 


N/A 


N/A 


N/A 


N/A 


N/A 


C028 


C028 


C028 


E-UTRAN 
System 
Simulator 
only 








MUlUI 1 IdllU wOO 

selection in E-UTRA 
with CSG list on 
USIM, removal of 
C.S^Gi ID frnm thp 
USIM 


nyi o 


1 U. 1 


M/A 


M/A 

Wl r\ 


M/A 
Wl r\ 


M/A 

Wl r\ 


M/A 








F-l ITRAM 

System 
Simulator 
only 






85 


Manual CSG 
selection in E-UTRA 
with CSG list on 
USIM, success 


Rel-8 


10.1.3 


N/A 


N/A 


N/A 


N/A 


N/A 


C028 


C028 


C028 


E-UTRAN 
System 
Simulator 
only 






86 


Manual CSG 
selection in E-UTRA 
with CSG list on 
USIM, rejected 


Rel-8 


10.1.4 


N/A 


N/A 


N/A 


N/A 


N/A 


C028 


C028 


C028 


E-UTRAN 
System 
Simulator 
only 
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Item 


Description 


Tested 


Test 


R99 ME 


Rel-4 


Rel-5 


Rel-6 


Rel-7 


Rel-8 


Rel-9 


Rel-10 


Network 


Sup 


Additional 






feature 
defined 


sequence(s 
) 




ME 


ME 


ME 


ME 


ME 


ME 


ME 


Depende 
ncy 


port 


test case 
execution 






in 






















rponiTiiinpnrlfl 

1 www! lllllwllvlCl 






Release 
























tion 


87 


CSG selection in E- 
UTRA with no CSG 
liqt nn IJSIM no IMS! 

lloL \Ji 1 KJyJiivlj 1 Ivy llvlOI 

change 


Rel-8 


10.1.5 


N/A 


N/A 


N/A 


N/A 


N/A 


C028 


C028 


C028 


E-UTRAN 
System 

Qirni llfltnr 
on 1 lUiciLvyi 

only 






88 


CSG selection in E- 
UTRA with no CSG 
listen USIM, with 

IIVIOI ICll I^C7 


Rel-8 


10.1.6 


N/A 


N/A 


N/A 


N/A 


N/A 


C028 


C028 


C028 


E-UTRAN 
System 
Simulator 

\j\ iiy 






89 


NAS security context 
parameter handling 
when service "EMM 
Information" is 
available 


Rel-8 


11.1 


N/A 


N/A 


N/A 


N/A 


N/A 


C027 


C027 


C027 


E-UTRAN 
System 
Simulator 
only 








MAQ cor*! irit\/ rr^ntoYt 

parameter handling 
when service "EMM 
Information" is not 
available, no IMS! 
change 


ntJi o 


1 1 


M/A 


M/A 


M/A 


M/A 


M/A 

IN//A 








F-l ITRAM 

1 ri/AIN 

System 
Simulator 
only 








MA^ cor*! irit\/ rrintovt 

parameter handling 

\/\/hfin cor\/ipo "FK/IKyi 

Vvl Id 1 Od VILrV? ^IVIIVI 

Information" is not 
available IMSI 
changed 


nci o 


1 1 .o 


M/A 

IN/ /A 


M/A 

IN/ /A 


M/A 

IN/ /A 


M/A 

IN/ /A 


M/A 

IN//A 








F-l ITRAM 

System 

Qimi ilatnr 
on 1 luiciiui 

only 






92 


CSG Type display 
test 


Rel-8 




















TBD 






93 


Home NodeB Name 
display test 


Rel-8 




















TBD 
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C001 (NOTA.1/3) AND A.1/4 
C002 A.1/1 AND A.1/3 
COOS A.1/3 AND A.1/4 

C004 IF (C001 OR C002) THEN M ELSE N/A 
COOS IF A.1/2 THEN M ELSE N/A 

C006 IF(C001 ORC002) AND A.1/5 AND A.1/1 8 THEN M 
ELSE N/A 

C007 IF (C001 OR C002) AND A.1/6 AND A.1/1 8 THEN M 
ELSE N/A 

C008 IF (C001 OR C002) AND A.1/6 AND A.1/1 8 THEN 0.1 
ELSE N/A 

C009 IF C003 THEN M ELSE N/A 
C010 IF (C001 OR (A.1/3 AND (IA.1/4)) OR (C003 AND 
(IA.1/7))) THEN M ELSE N/A 



C01 1 IF C003 AND A.1/7 THEN M ELSE O 

C012 IFA.1/8THEN M ELSE N/A 

C013 IFA.1/9THEN M ELSE N/A 

C014 IFA.1/8 AND A.1/9 THEN M ELSE N/A 

C015 IF A.1/1 THEN M ELSE N/A 

C016 IF A.1/1 1 AND A.1/12 AND A.1/13 THEN M ELSE N/A 

C017 IF A.1/1 1 AND A.1/13 THEN M ELSE N/A 

C018 IF A.1/1 1 AND A.1/14 THEN M ELSE N/A 

C019 IFA.1/15THEN M ELSE N/A 

C020 IF (NOT A.1/1 5) M ELSE N/A 

C021 IF A.1/16THEN M ELSE N/A 

C022 IF A.1/1 7 THEN M ELSE N/A 

C023 IF A.1/1 8 THEN M ELSE N/A 

C024 IF C004 AND A.1/1 8 THEN M ELSE N/A 

C025 IF A.1/1 9 THEN "Expected Sequence A" M ELSE 

"Expected Sequence B" M 

C026 IF A1/2 AND A.1/1 9 THEN "Expected Sequence A" M 

ELSE IF A.1/2 "Expected Sequence B" M ELSE N/A 

C027 IF (A.1/20 OR A.1/21) THEN M ELSE N/A 

C028 IF (A.1/20 OR A.1/21) AND A.1/22 THEN M ELSE N/A 

C029 IF (A.1/20 OR A.1/21) AND A.1/1 5 THEN M ELSE N/A 

C030 IF (A.1/20 OR A.1/21) AND NOT A.1/1 5 THEN M ELSE 

N/A 

C031 IF (A.1/1 AND A.1/23 AND (A.1/20 OR A.1/21)) THEN 
M ELSE N/A 

rn^o IP i/in amh amr a amr a twpm m pi qp 
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-- (NOT 0_UTRAN) AND 0_GERAN 

-- 0_CS AND 0_UTRAN 

-- 0_UTRAN AND 0_GERAN 

-- ((NOT 0_UTRAN) AND 0_GERAN) OR (0_CS AND 0_UTRAN) 
-- 0_PIN2_ENTRY_FEAT 

-- (((NOT 0_UTRAN) AND 0_GERAN) OR (0_CS AND 0_UTRAN) 
AND 0_FDN AND 0_Speech_Calls 

-- (((NOT 0_UTRAN) AND 0_GERAN) OR (0_CS AND 0_UTRAN)) 
AND 0_AoCC AND 0_Speech_Calls 

-- (((NOT 0_UTRAN) AND 0_GERAN) OR (0_CS AND 0_UTRAN)) 
AND 0_AoCC AND 0_Speech_Calls 

-- 0_UTRAN AND 0_GERAN 

-- (((NOT 0_UTRAN) AND 0_GERAN) OR (0_UTRAN AND (NOT 
0_GERAN)) OR (0_UTRAN AND 0_GERAN AND (NOT 
0_HPLMNwACT))) 

-- 0_UTRAN AND 0_GERAN AND 0_HPLMNwACT 

-- 0_Local_PB 
-- 0_Global_PB 

-- 0_Local_PB AND 0_Global_PB 

-- 0_Store_Received_SMS 

-- 0_MMS AND 0_MMS_USIM_DATA AND 

0_NO_USER_MMS_CONF_SELEC 
-- 0_MMS AND 0_NO_USER_MMS_CONF_SELEC 

-- 0_MMS AND 0_MMS_NOTIF_STORAGE 

-- 0_ACL 

-- NOTO_ACL 

-- 0_SDN 

-- 0_EFPLMNwACT_numerical entry 
-- 0_Speech_Calls 

-- (((NOT 0_UTRAN) AND 0_GERAN) OR (0_CS AND 0_UTRAN)) 

AND 0_Speech_Calls 
-- 0_PIN_MMI_Strings 

-- (0_PIN2_ENTRY_FEAT AND 0_PIN_MMI_Strings) OR 

0_PIN2_ENTRY_FEAT 
-- pc_eFDD OR pc_eTDD 

-- (pc_eFDD OR pc_eTDD) AND pc_Allowed_CSG_list 

-- (pc_eFDD OR pc_eTDD) AND 0_ACL 

-- (pc_eFDD OR pc_eTDD) AND NOT 0_ACL 

-- 0_Store_Received_SMS AND pc_SM-over-IP receiver AND 
(pc_eFDD OR pc_eTDD) 

QtnrQ Rq^qIv/qH _Q^yl_Q AM Pi nr> _Q^yl-n\/Qr-IP ro^Qiv/Qr AM Pi 
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Default Values 



All tests defined in the subsequent clauses apply to Terminals using card types specified in ETSI TS 102 221 [5], unless 
otherwise stated. 

The following sequence of tests confirms: 

a) the correct interpretation of data read from the USIM (Universal Subscriber Identification Module) by the 
Terminal; 

b) the correct writing of data to the USIM by the Terminal; 

c) the initiation of appropriate procedures by the Terminal; 

d) High level protocols. 

All tests apply to the USIM appHcation on the UICC. 

A USIM simulator will be required as part of the USS. Alternatively, to perform the logical tests, USIMs progranmied 
with specific data may be used. The USIM data is not defined within the initial conditions of the tests unless it differs 
from the default values defined below. 

4.1 Definition of default values for USIM-Terminal interface 
testing (Default UICC) 

A USIM containing the following default values is used for all tests of this present document unless otherwise stated. 
For each data item, the logical default values and the coding within the elementary files (EF) of the USIM follow. 
NOTE 1 : Bx represents byte x of the coding. 

NOTE 2: Unless otherwise defined, the coding values are hexadecimal. 

4.1 .1 Values of the EPs (Default UICC) 



4.1.1.1 

Logically: 



EFiMsi (IMSI) 

2460813579 



Coding: 
Hex 



B1 
06 



B2 
21 



B3 
64 



84 
80 



B5 
31 



B6 
75 



87 
F9 



B8 
FF 



B9 
FF 



4.1 .1 .2 EFad (Administrative Data) 

Logically: Normal operation 

OFM to be deactivated by the Terminal 
MNC: 3 digit 



Coding: 81 
Hex 00 



B2 
00 



B3 
00 



84 
03 



4.1.1.3 

Logically: 



EFloci (Location Information) 



LAI-MCC: 246 

LAI-MNC: 081 

LAI-LAC: 0001 

TMSL "FF .. FF" 
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Coding: B1 B2 B3 B4 B5 B6 B7 B8 B9 B10 B11 
Hex FF FF FF FF 42 16 80 00 01 FF 00 



4.1.1.4 

Logically: 



Coding: 
Hex 



B1 
Ox 



EpKeys (Ciphering and Integrity Keys) 



Key Set Identifier KSI: 
Ciphering Keys CK: 
Integrity Keys IK: 



B2 

XX 



B3 

XX 



Ox 

XX 
XX 



B16 

XX 



B17 

XX 



BIB 

XX 



B30 

XX 



B31 

XX 



B32 

XX 



B33 

XX 



4.1.1.5 

Logically: 



Coding: 
Hex 



B1 
Ox 



EpKeysPs (Ciphering and Integrity Keys for Packet Switched donnain) 



Key Set Identifier KSI: 
Ciphering Keys CK: 
Integrity Keys IK: 



B2 

XX 



B3 

XX 



Ox 

XX 
XX 



B16 

XX 



B17 

XX 



B18 

XX 



B31 

XX 



B32 

XX 



B33 

XX 



4.1 .1 .6 EPacc (Access Control Class) 

Logically: One and only one access class from 0-9, e.g. class 7 for which the coding is "00 80" 



4.1 .1 .7 EPfplmn (Porbidden PLMNs) 

Besides of the 4 mandatory EFfplmn 2 optional EFfplmn are defined according to TS 31.102 [4], subclause 4.2.16. 
Logically: 



PLMNl 
PLMN2 
PLMNS 
PLMN4 
PLMNS 
PLMN6 



234 001 (MCC MNC) 
234 002 
234 003 
234 004 
234 005 
234 006 



Coding: 


B1 


B2 


B3 


B4 


B5 


B6 


B7 


B8 


B9 


BIO 


B11 


B12 


Hex 


32 


14 


00 


32 


24 


00 


32 


34 


00 


32 


44 


00 




B13 


B14 


B15 


B16 


B17 


B18 
















32 


54 


00 


32 


64 


00 















4.1 .1 .8 EFusT (USIM Service Table) 

Logically: Local Phone Book available 

User controlled PLMN selector available 
Fixed dialling numbers available 
Barred dialling numbers available 
The GSM Access available 

The Group Identifier level 1 and level 2 not available 
Service n 33 (Packed Switched Domain) shall be set to T 
Enabled Services Table available 



Coding: B1 B2 B3 B4 B5 

binary xxl x xxl 1 xxxx xxxx xxxx 1 xOO xxxx x1 xx xxxx xxl 1 
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The coding of EFust shall conform with the capabilities of the USIM used. 



4.1 .1 .9 EFest (Enable Service Table) 

Logically: Fixed Dialling Numbers (FDN) disabled. 

Barred Dialling Numbers (BDN) disabled. 
APN Control Hst (ACL) disabled 



Coding: B1 
binary 0000 0000 



The coding of EFest shall conform with the capabilities of the USIM, unused Bits are set to '0'. 



4.1 .1 .10 EFadn (Abbreviated Dialling Number) 



Logically: 

At least 10 records, each non empty record unique. 



Record 1 : Length of alpha identifier: 

Alpha identifier: 
Length of BCD number: 
TON and NPI: 
Dialled number: 
CCI: 
Extl: 



32 characters; 

"ABCDEFGHIJKLMNOPQRSTUVWXYZABCDEF"; 

"03"; 

Telephony and Unknown; 

123; 

None; 

None. 



Record 1: 



Coding: 
Hex 



B1 
41 



B2 
42 



B3 
43 



B32 B33 B34 B35 B36 B37 B38 B39 
46 03 81 21 F3 FF FF FF 



B46 
FF 



4.1 .1 .1 1 EFpLMNwACT (User Controlled PLMN Selector with Access Technology) 

Besides of the 8 mandatory PLMN w ACT entries 4 optional PLMN w ACT entries are defined according to 

TS 31.102 [4], subclause 4.2.5. The Radio Access Technology identifier for the first two PLMN (1'^ PLMN and 2' 

PLMN) are set to both UTRAN and GSM, all other PLMN to UTRAN only. 



Logically: 



V PLMN: 


244 081 (MCC MNC) 


V ACT: 


UTRAN 


2"^ PLMN: 


244 081 


2^^ ACT: 


GSM 


3'^ PLMN: 


244 082 


3''* ACT: 


UTRAN 


4'^ PLMN: 


244 082 


4* ACT: 


GSM 


5'^ PLMN: 


244 003 


5* ACT: 


UTRAN 


6'^ PLMN: 


244 004 


6'^ ACT: 


UTRAN 


7* PLMN: 


244 005 


1'^ ACT: 


UTRAN 


8'^ PLMN: 


244 006 


8* ACT: 


UTRAN 


9* PLMN: 


244 007 


9* ACT: 


UTRAN 


10* PLMN: 


244 008 


10* ACT: 


UTRAN 


11* PLMN: 


244 009 


11* ACT: 


UTRAN 


12* PLMN: 


244 010 
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12'^ ACT: UTRAN 



Coding: 
Hex 



B1 


B2 


B3 


B4 


B5 


B6 


B7 


B8 


B9 


BIO 


B11 


B12 


B13 


B14 


B15 


42 


14 


80 


80 


00 


42 


14 


80 


00 


80 


42 


24 


80 


80 


00 


B16 


B17 


B18 


B19 


B20 


B21 


B22 


B23 


B24 


B25 


B26 


B27 


B28 


B29 


B30 


42 


24 


80 


00 


80 


42 


34 


00 


80 


00 


42 


44 


00 


80 


00 


B31 


B32 


B33 


B34 


B35 


B36 


B37 


B38 


B39 


B40 


B41 


B42 


B43 


B44 


B45 


42 


54 


00 


80 


00 


42 


64 


00 


80 


00 


42 


74 


00 


80 


00 


B46 


B47 


B48 


B49 


B50 


B51 


B52 


B53 


B54 


B55 


B56 


B57 


B58 


B59 


B60 


42 


84 


00 


80 


00 


42 


94 


00 


80 


00 


42 


04 


10 


80 


00 



4.1 .1 .12 EFopLMNwACT (Operator Controlled PLMN Selector with Access Technology) 

The Radio Access Technology identifier for the first PLMN is set to both UTRAN and GSM, the other remaining 
PLMNs to UTRAN only. 



Logically: 



V PLMN: 


254 001 (MCC MNC) 


V ACT: 


UTRAN 


2^^ PLMN: 


254 001 


2"^ ACT: 


GSM 


3'^ PLMN: 


254 002 


3'^ ACT: 


UTRAN 


4* PLMN: 


254 003 


4* ACT: 


UTRAN 


5'^ PLMN: 


254 004 


5* ACT: 


UTRAN 


6* PLMN: 


254 005 


6* ACT: 


UTRAN 


PLMN: 


254 006 


7* ACT: 


UTRAN 


8* PLMN: 


254 007 


8* ACT: 


UTRAN 



Coding: 


B01 


B02 


B03 


B04 


B05 


B06 


B07 


B08 


B09 


BIO 


Hex 


52 


14 


00 


80 


00 


52 


14 


00 


00 


80 




B11 


B12 


B13 


B14 


B15 


B16 


B17 


B18 


B19 


B20 




52 


24 


00 


80 


00 


52 


34 


00 


80 


00 




B21 


B22 


B23 


B24 


B25 


B26 


B27 


B28 


B29 


B30 




52 


44 


00 


80 


00 


52 


54 


00 


80 


00 




B31 


B32 


B33 


B34 


B35 


B36 


B37 


B38 


B39 


B40 




52 


64 


00 


80 


00 


52 


74 


00 


80 


00 



4.1.1.13 Void 

4.1.1.14 PIN 

Key reference: 01 

Logically: 2468 

Coding: B1 B2 B3 B4 B5 B6 B7 B8 
Hex 32 34 36 38 FF FF FF FF 

4.1.1.15 PIN2 

Key reference: 81 
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Logically: 3579 

Coding: B1 B2 B3 84 B5 B6 B7 B8 
Hex 33 35 37 39 FF FF FF FF 



4.1.1.16 Unblock PIN 

Key reference: 01 

Logically: 13243546 

Coding: B1 B2 B3 B4 B5 B6 B7 B8 
Hex 31 33 32 34 33 35 34 36 



4.1.1.17 Unblock PIN2 

Key reference: 81 

Logically: 08978675 

Coding: B1 B2 B3 B4 B5 B6 B7 B8 
Hex 30 38 39 37 38 36 37 35 



4.1 .1 .18 Other Values of the USIM 

All other values of Efs provided by the USIM shall be set to the default values defined in the annex E of TS 31.102 [4]. 
Some Efs (like the GSM Access files) may necessary for some tests and apply only to those test cases. 

4.1 .1 .19 EFpsLoci (Packet Switch Location Information) 

Logically: RAI-MCC: 246 

RAI-MNC: 081 
RAI-LAC: 0001 
RAI-RAC: 05 

P-TMSI: "FF....FF" 
P-TMSI signature value: "FF. . .FF" 



Coding: 


B1 


B2 


B3 


B4 


B5 


B6 


B7 


B8 


B9 


BIO 


B11 


Hex 


FF 


FF 


FF 


FF 


FF 


FF 


FF 


42 


16 


80 


00 


Coding: 


B12 


B13 


B14 


















Hex 


01 


05 


00 



















4.1.1.20 Universal PIN 

Key reference: 11 

Logically: 2839 

Coding: B1 B2 B3 B4 B5 B6 B7 B8 
Hex 32 38 33 39 FF FF FF FF 



4.1 .1 .21 Unblock Universal PIN 

Key reference: 11 

Logically: 02030405 
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Coding: B1 B2 B3 B4 B5 B6 B7 B8 
Hex 30 32 30 33 30 34 30 35 

4.2 Definition of FDN UlCC 

The FDN test cases require a different configuration than the one described in subclause 4.1. For that purpose a default 
FDN UICC is defined. In general the values of the FDN UICC are identical to the default UICC, with the following 
exceptions. 

4.2.1 Values of the EPs (FDN UICC) 

4.2.1 .1 EFusT (USIM Service Table) 

Logically: Local Phone Book available 

User controlled PLMN selector available 
Fixed dialling numbers available 
Barred dialling numbers available 
The GSM Access available 

The Group Identifier level 1 and level 2 not available. 
Service n 33 (Packed Switched Domain) shall be set to T 
Enabled Services Table available 

Coding: B1 B2 B3 B4 B5 

binary xx1xxx11 xxxxxxxx xxxxIxOO xxxxxixx xxxx xx11 

The coding of EFust shall conform with the capabilities of the USIM used. 

4.2.1 .2 EFest (Enable Service Table) 

Logically: Fixed Dialling Numbers enabled. 

Barred Dialling Numbers disabled. 
APN Control list (ACL) disabled. 

Coding: B1 
Binary 0000 0001 

The coding of EFest shall conform with the capabilities of the USIM, unused Bits are set to '0'.. 

4.2.1 .3 EFfdn (Fixed Dialling Numbers) 

Logically: 

Record 1: Length of alpha identifier: 6 characters; 

Alpha identifier: "FDNl 11"; 

Length of BCD number: "06" ; 

TON and NPI: Telephony and International; 

Dialled number: +1357924680; 

CCI2: None; 



Ext2: None. 



Coding for record 1 : 





B1 


B2 


B3 


B4 


B5 


B6 


B7 


B8 


B9 


BIO 


B11 


B12 


B13 


Hex 


46 


44 


4E 


31 


31 


31 


06 


91 


31 


75 


29 


64 


08 




B14 


B15 


B16 


B17 


B18 


B19 


B20 
















FF 


FF 


FF 


FF 


FF 


FF 


FF 
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Record 2: 



Length of alpha identifier: 6 characters; 



Alpha identifier: 
Length of BCD number: 
TON and NPL 
Dialled number: 
CCI2: 
Ext2: 



"FDN222"; 
"04"; 

Telephony and Unknown; 

24680; 

None; 

None. 



Coding for record 2: 





B1 


B2 


B3 


B4 


B5 


B6 


B7 


B8 


B9 


B10 


B11 


B12 


B13 


Hex 


46 


44 


4E 


32 


32 


32 


04 


81 


42 


86 


FO 


FF 


FF 




B14 


B15 


B16 


B17 


B18 


B19 


B20 
















FF 


FF 


FF 


FF 


FF 


FF 


FF 















Length of alpha identifier: 
Alpha identifier: 
Length of BCD number: 
TON and NPL 
Dialled number: 
CCI2: 
Ext2: 



6 characters; 

"FDN333"; 

"OB"; 

Telephony and International; 

+12345678901234567890; 

None; 

None. 



Coding for record 3: 





B1 


B2 


B3 


B4 


B5 


B6 


B7 


B8 


B9 


BIO 


B11 


B12 


B13 


Hex 


46 


44 


4E 


33 


33 


33 


OB 


91 


21 


43 


65 


87 


09 




B14 


B15 


B16 


B17 


B18 


B19 


B20 
















21 


43 


65 


87 


09 


FF 


FF 















4.2.1 .4 EFecc (Emergency Call Codes) 

Logically: Emergency call code: "122"; 

Emergency call code alpha identifier: "TEST"; 

Emergency call Service Category: Mountain Rescue. 

Coding: B1 B2 B3 B4 B5 B6 B7 B8 

Hex 21 F2 FF 54 45 53 54 10 



4.2.1 .5 Other Values of the USIM 

All other values of Efs provided by the USIM shall be set to the default values defined in the annex E of TS 31.102 [4]. 
Some Efs (like the GSM Access files) may necessary for some tests and apply only to those test cases. 



4.3 Void 

4.4 Definition of E-UTRAN/EPC UlCC 

The E-UTRAN/EPC test cases require a different configuration than the one described in subclause 4.1. For that 
purpose a default E-UTRAN/EPC UICC is defined. In general the values of the E-UTRAN/EPC UICC are identical to 
the default UICC, with the following exceptions: 

4.4.1 EFusT (USIM Service Table) 

Logically: Local Phone Book available 
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User controlled PLMN selector available 
Fixed dialling numbers available 
Barred dialling numbers available 
The GSM Access available 

The Group Identifier level 1 and level 2 not available 
Service n 33 (Packed Switched Domain) shall be set to T 
Enabled Services Table available 
EPS Mobility Management Information available 
Allowed CSG Lists and corresponding indications 



Byte: B1 82 B3 B4 85 B6 B7 88 

Binary: xx1xxx11 xxxx xxxx xxxxIxOO xxxxxixx xxxx xx11 xxxx xxxx xxxx xxxx xxxx xxxx 

89 B10 B11 

xxxx xxxx xxxx xxxx xx1 1 xxxx 



The coding of EFust shall conform with the capabilities of the USIM used. 



4.4.2 EFepsloci (EPS Information) 

Logically: GUTI: 24608100010266341 122 

Last visited registered TAI: 246/081/0001 
EPS update status: not updated 



Byte: 


B1 


B2 


B3 


B4 


B5 


B6 


B7 


B8 


B9 


BIO 


B11 


Hex: 


OB 


F6 


42 


16 


80 


00 


01 


02 


66 


43 


11 




B12 


B13 


B14 


B15 


B16 


B17 


B18 












22 


42 


16 


80 


00 


01 


01 











4.4.3 EFpLMNwACT (User Controlled PLMN Selector with Access Technology) 

Besides of the 8 mandatory PLMN w ACT entries 4 optional PLMN w ACT entries are defined according to 

TS 31.102 [4], subclause 4.2.5. The Radio Access Technology identifiers are set either to E-UTRAN only, UTRAN 

only or GSM only. 



V PLMN: 


244 081 (MCC MNC) 


V ACT: 


E-UTRAN 


2"^ PLMN: 


244 081 


2"^ ACT: 


GSM 


3'"^ PLMN: 


244 083 


3'^ ACT: 


E-UTRAN 


4* PLMN: 


244 082 


4'^ ACT: 


GSM 


5'^ PLMN: 


244 003 


5* ACT: 


E-UTRAN 


6'^ PLMN: 


244 004 


6'^ ACT: 


UTRAN 


7* PLMN: 


244 005 


7'^ ACT: 


UTRAN 


8* PLMN: 


244 081 


8* ACT: 


UTRAN 


9'^ PLMN: 


244 007 


9'^ ACT: 


UTRAN 


10* PLMN: 


244 008 


10'^ ACT: 


E-UTRAN 
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ir^PLMN: 244 009 

11'^ ACT: UTRAN 

12'^PLMN: 244 010 

12* ACT: E-UTRAN 



Coding: 
Hex 



B1 


B2 


B3 


B4 


B5 


B6 


B7 


B8 


B9 


BIO 


B11 


B12 


B13 


B14 


B15 


42 


14 


80 


40 


00 


42 


14 


80 


00 


80 


42 


34 


80 


40 


00 


B16 


B17 


B18 


B19 


B20 


B21 


B22 


B23 


B24 


B25 


B26 


B27 


B28 


B29 


B30 


42 


24 


80 


00 


80 


42 


34 


00 


40 


00 


42 


44 


00 


80 


00 


B31 


B32 


B33 


B34 


B35 


B36 


B37 


B38 


B39 


B40 


B41 


B42 


B43 


B44 


B45 


42 


54 


00 


80 


00 


42 


14 


80 


80 


00 


42 


74 


00 


80 


00 


B46 


B47 


B48 


B49 


B50 


B51 


B52 


B53 


B54 


B55 


B56 


B57 


B58 


B59 


B60 


42 


84 


00 


40 


00 


42 


94 


00 


80 


00 


42 


04 


10 


40 


00 



4.4.4 EFopLMNwACT (Operator Controlled PLMN Selector with Access Technology) 

The Radio Access Technology identifier for the first PLMN is set to both UTRAN and GSM, the other remaining 
PLMNs to UTRAN only. 



V PLMN: 


254 001 (MCC MNC) 


V ACT: 


E-UTRAN 


2^^ PLMN: 


254 001 


2"^ ACT: 


GSM 


3'"^ PLMN: 


254 002 


3'^ ACT: 


E-UTRAN 


4* PLMN: 


254 003 


4* ACT: 


E-UTRAN 


5* PLMN: 


254 004 


5* ACT: 


UTRAN 


6* PLMN: 


254 005 


6* ACT: 


UTRAN 


7* PLMN: 


254 006 


1'^ ACT: 


UTRAN 


8* PLMN: 


254 007 


8'^ ACT: 


UTRAN 



Coding: 


B01 


B02 


B03 


B04 


B05 


B06 


B07 


B08 


B09 


BIO 


Hex 


52 


14 


00 


40 


00 


52 


14 


00 


00 


80 




B11 


B12 


B13 


B14 


B15 


B16 


B17 


B18 


B19 


B20 




52 


24 


00 


40 


00 


52 


34 


00 


40 


00 




B21 


B22 


B23 


B24 


B25 


B26 


B27 


B28 


B29 


B30 




52 


44 


00 


80 


00 


52 


54 


00 


80 


00 




B31 


B32 


B33 


B34 


B35 


B36 


B37 


B38 


B39 


B40 




52 


64 


00 


80 


00 


52 


74 


00 


80 


00 



4.4.5 EFacsgl (Allowed CSG Lists) 

For testing 2 CSG lists are defined and stored together in record one. 
Logically: 



V' CSG list 



PLMN: 246 08 1 (MCC MNC) 

CSG list 1^' CSG Type indication 02 

V CSG list 1'' CSG HNB Name indication 02 

V CSG list 1^' CSG CSG ID: 02 (27bit) 
CSG list 2"^ CSG Type indication 03 

CSG list 2^^^ CSG HNB Name indication 03 
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V CSG list 2^^ CSG CSG ID: 03 (27bit) 



2nd CSG list 

PLMN: 244 08 1 (MCC MNC) 

2"^ CSG list CSG Type indication 08 

2"^ CSG list 1^' CSG HNB Name indication 08 

2"^ CSG list 1^' CSG CSG ID: 08 (27bit) 



Byte: 


B01 


B02 


BOS 


B04 


BOS 


B06 


B07 


B08 


B09 


BIO 


Coding: 


AO 


15 


80 


03 


42 


16 


80 


81 


06 


02 




B11 


B12 


B13 


B14 


B15 


B16 


B17 


B18 


B19 


B20 


02 


00 


00 


00 


5F 


81 


06 


03 


03 


00 


B21 


B22 


B23 


B24 


B25 


B26 


B27 


B28 


B29 


B30 


00 


00 


7F 


AO 


OD 


80 


03 


42 


14 


80 


B31 


B32 


B33 


B34 


B35 


B36 


B37 


B38 


B39 




81 


06 


08 


08 


00 


00 


01 


IF 


FF 


FF 


Bxx 




















FF 





















All other records are empty. 

4.4.6 EFcsGT (CSG Type) 



Record 1: 



Logically: Group ONE 



Byte: 


B01 


B02 


B03 


B04 


B05 


B06 


B07 


B08 


B09 


BIO 


Coding: 


89 


13 


80 


00 


47 


00 


72 


00 


6F 


00 




B11 


B12 


B13 


B14 


B15 


B16 


B17 


B18 


B19 


B20 


75 


00 


70 


00 


20 


00 


4F 


00 


4E 


00 


B21 


B22 


B23 


B24 


B25 


B26 


B27 


B28 


B29 


B30 


45 


FF 


FF 


FF 


FF 


FF 


FF 


FF 


FF 


FF 



Record 2: 



Logically: Group TWO 



Byte: 


B01 


B02 


B03 


B04 


B05 


B06 


B07 


B08 


B09 


BIO 


Coding: 


89 


13 


80 


00 


47 


00 


72 


00 


6F 


00 




B11 


B12 


B13 


B14 


B15 


B16 


B17 


B18 


B19 


B20 


75 


00 


70 


00 


20 


00 


54 


00 


57 


00 


B21 


B22 


B23 


B24 


B25 


B26 


B27 


B28 


B29 


B30 


4F 


FF 


FF 


FF 


FF 


FF 


FF 


FF 


FF 


FF 



Record 3: 



Logically: Group THREE 



Byte: 


B01 


B02 


B03 


B04 


B05 


B06 


B07 


B08 


B09 


BIO 


Coding: 


89 


17 


80 


00 


47 


00 


72 


00 


6F 


00 




B11 


B12 


B13 


B14 


B15 


B16 


B17 


B18 


B19 


B20 


75 


00 


70 


00 


20 


00 


54 


00 


48 


00 


B21 


B22 


B23 


B24 


B25 


B26 


B27 


B28 


B29 


B30 


52 


00 


45 


00 


45 


FF 


FF 


FF 


FF 


FF 



Record 4: 
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Logically: Group FOUR 



Byte: 


B01 


B02 


BOS 


B04 


B05 


B06 


B07 


B08 


B09 


B10 


Coding: 


89 


15 


80 


00 


47 


00 


72 


00 


6F 


00 




B11 


B12 


B13 


B14 


B15 


B16 


B17 


B18 


B19 


B20 


75 


00 


70 


00 


20 


00 


46 


00 


4F 


00 


B21 


B22 


B23 


B24 


B25 


B26 


B27 


B28 


B29 


B30 


55 


00 


52 


FF 


FF 


FF 


FF 


FF 


FF 


FF 



Record 5: 



Logically: Group FIVE 



Byte: 


B01 


B02 


BOS 


B04 


B05 


B06 


B07 


BOS 


B09 


BIO 


Coding: 


89 


15 


80 


00 


47 


00 


72 


00 


6F 


00 




B11 


B12 


BIS 


B14 


B15 


B16 


B17 


BIS 


B19 


B20 


75 


00 


70 


00 


20 


00 


46 


00 


49 


00 


B21 


B22 


B2S 


B24 


B25 


B26 


B27 


B28 


B29 


BSO 


56 


00 


45 


FF 


FF 


FF 


FF 


FF 


FF 


FF 



Record 6: 



Logically: Group SIX 



Byte: 


B01 


B02 


BOS 


B04 


B05 


B06 


B07 


BOS 


B09 


BIO 


Coding: 


89 


IS 


80 


00 


47 


00 


72 


00 


6F 


00 




B11 


B12 


BIS 


B14 


B15 


B16 


B17 


BIS 


B19 


B20 


75 


00 


70 


00 


20 


00 


5S 


00 


49 


00 


B21 


B22 


B2S 


B24 


B25 


B26 


B27 


B28 


B29 


BSO 


58 


FF 


FF 


FF 


FF 


FF 


FF 


FF 


FF 


FF 



Record 7: 



Logically: Group SEVEN 



Byte: 


B01 


B02 


BOS 


B04 


B05 


B06 


B07 


B08 


B09 


BIO 


Coding: 


89 


17 


80 


00 


47 


00 


72 


00 


6F 


00 




B11 


B12 


BIS 


B14 


B15 


B16 


B17 


BIS 


B19 


B20 


75 


00 


70 


00 


20 


00 


5S 


00 


45 


00 


B21 


B22 


B2S 


B24 


B25 


B26 


B27 


B28 


B29 


BSO 


56 


00 


45 


00 


4E 


FF 


FF 


FF 


FF 


FF 



Record 8: 



Logically: Group EIGHT 



Byte: 


B01 


B02 


BOS 


B04 


B05 


B06 


B07 


BOS 


B09 


BIO 


Coding: 


89 


17 


80 


00 


47 


00 


72 


00 


6F 


00 




B11 


B12 


BIS 


B14 


B15 


B16 


B17 


B18 


B19 


B20 


75 


00 


70 


00 


20 


00 


45 


00 


49 


00 


B21 


B22 


B2S 


B24 


B25 


B26 


B27 


B28 


B29 


BSO 


47 


00 


48 


00 


54 


FF 


FF 


FF 


FF 


FF 



4.4.7 EFhnbn (Home (e)NodeB Name) 

Record 1: 

Logically: Home ONE 
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Byte: 


B01 


B02 


B03 


B04 


B05 


B06 


B07 


B08 


B09 


BIO 


Coding: 


80 


11 


80 


00 


48 


00 


6F 


00 


6D 


00 




B11 


B12 


B13 


B14 


B15 


B16 


B17 


B18 


B19 


B20 




65 


00 


20 


00 


4F 


00 


4E 


00 


45 


FF 




B21 


B22 


B23 


B24 


B25 


B26 


B27 


B28 


B29 


B30 




FF 


FF 


FF 


FF 


FF 


FF 


FF 


FF 


FF 


FF 


Record 2: 






















Logically: 


Home TWO 


















Byte: 


B01 


B02 


B03 


B04 


B05 


B06 


B07 


B08 


B09 


BIO 


Coding: 


80 


11 


80 


00 


48 


00 


6F 


00 


6D 


00 




B11 


B12 


B13 


B14 


B15 


B16 


B17 


B18 


B19 


B20 




65 


00 


20 


00 


54 


00 


57 


00 


4F 


FF 




B21 


B22 


B23 


B24 


B25 


B26 


B27 


B28 


B29 


B30 




FF 


FF 


FF 


FF 


FF 


FF 


FF 


FF 


FF 


FF 


Record 3: 






















Logically: 


Home THREE 


















Byte: 


B01 


B02 


B03 


B04 


BOS 


B06 


B07 


B08 


B09 


BIO 


Coding: 


80 


15 


80 


00 


48 


00 


6F 


00 


6D 


00 




B11 


B12 


B13 


B14 


B15 


B16 


B17 


B18 


B19 


B20 




65 


00 


20 


00 


54 


00 


48 


00 


52 


00 




B21 


B22 


B23 


B24 


B25 


B26 


B27 


B28 


B29 


B30 




45 


00 


45 


FF 


FF 


FF 


FF 


FF 


FF 


FF 


Record 4: 






















Logically: 


Home FOUR 


















Byte: 


B01 


B02 


B03 


B04 


B05 


B06 


B07 


B08 


B09 


BIO 


Coding: 


80 


13 


80 


00 


48 


00 


6F 


00 


6D 


00 




B11 


B12 


B13 


B14 


B15 


B16 


B17 


B18 


B19 


B20 




65 


00 


20 


00 


46 


00 


4F 


00 


55 


00 




B21 


B22 


B23 


B24 


B25 


B26 


B27 


B28 


B29 


B30 




52 


FF 


FF 


FF 


FF 


FF 


FF 


FF 


FF 


FF 


Record 5: 






















Logically: 


Home FIVE 


















Byte: 


B01 


B02 


B03 


B04 


B05 


B06 


B07 


B08 


B09 


BIO 


Coding: 


80 


13 


80 


00 


48 


00 


6F 


00 


6D 


00 




B11 


B12 


B13 


B14 


B15 


B16 


B17 


B18 


B19 


B20 




65 


00 


20 


00 


46 


00 


49 


00 


56 


00 




B21 


B22 


B23 


B24 


B25 


B26 


B27 


B28 


B29 


B30 




45 


FF 


FF 


FF 


FF 


FF 


FF 


FF 


FF 


FF 


Record 6: 






















Logically: 


Home SIX 


















Byte: 


B01 


B02 


B03 


B04 


B05 


B06 


B07 


B08 


B09 


BIO 


Coding: 


80 


11 


80 


00 


48 


00 


6F 


00 


6D 


00 




B11 


B12 


B13 


B14 


B15 


B16 


B17 


B18 


B19 


B20 




65 


00 


20 


00 


53 


00 


49 


00 


58 


FF 




B21 


B22 


B23 


B24 


B25 


B26 


B27 


B28 


B29 


B30 




FF 


FF 


FF 


FF 


FF 


FF 


FF 


FF 


FF 


FF 
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Record 7: 

Logically: Home SEVEN 



Byte: 


B01 


B02 


BOS 


B04 


B05 


B06 


B07 


B08 


B09 


BIO 


Coding: 


80 


15 


80 


00 


48 


00 


6F 


00 


6D 


00 




B11 


B12 


d13 


d14 


bio 


d1 6 


f-) H "7 

d1 7 


d18 


d1 9 


d20 




65 


00 


20 


00 


5S 


00 


45 


00 


56 


00 




B21 


B22 


B23 


B24 


B25 


B26 


B27 


B28 


B29 


BSO 




45 


00 


4E 


FF 


FF 


FF 


FF 


FF 


FF 


FF 


Record 8: 






















Logically: 


Home EIGHT 


















Byte: 


B01 


B02 


BOS 


B04 


B05 


B06 


B07 


BOS 


B09 


BIO 


Coding: 


80 


15 


80 


00 


48 


00 


6F 


00 


6D 


00 




B11 


B12 


BIS 


B14 


B15 


B16 


B17 


BIS 


B19 


B20 




65 


00 


20 


00 


45 


00 


49 


00 


47 


00 




B21 


B22 


B2S 


B24 


B25 


B26 


B27 


B28 


B29 


BSO 




48 


00 


54 


FF 


FF 


FF 


FF 


FF 


FF 


FF 



4.4.8 

Logically: 



EFepsnsc (EPS NAS Security Context) 



Key Set Identifier KSIasme- 
ASME Key (KSIasme): 
Uplink NAS count: 
Downlink NAS count: 
Identifiers of selected NAS 
integrity and encryption 
algorithm 



'07' (no key available) 

'FF' (not available) 

'GO' 

'GO' 

'FF' 



Coding: B1 
Hex AO 



B2 

XX 



BS 
80 



B4 
01 



B5 
07 



B6 
81 



B7 
00 



Bxx 

XX 



4.5 Definition of E-UTRAN/EPC ISIM-UICC 

4.5.1 Applications on the E-UTRAN/EPC ISIM-UICC 

The E-UTRAN/EPC ISIM-UICC shall contain a USIM as defined in clause 4.5.2 and an ISIM as defined in clause 
4.5.3. 

4.5.2 Default USIM values on E-UTRAN/EPC ISIM-UICC 

The E-UTRAN/EPC ISIM-UICC related test cases require a USIM to access the E-UTRAN/EPC. For this purpose the 
USIM shall be configured as defined in clause 4.4. 

4.5.3 Default ISIM values on E-UTRAN/EPC ISIM-UICC 

The E-UTRAN/EPC ISIM-UICC shall contain an ISIM for IMS access with the following values: 

4.5.3.1 EFad (Administrative Data) 



Logically: Normal Operation 



Byte: 


B1 


82 


83 


Coding: 


00 


00 


00 
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4.5.3.2 EFisT (ISIM Service Table) 

Logically: 

(Service 01) P-CSCF Address: 
(Service 02) Generic Bootstrapping: 
(Service 03) HTTP Digest: 

(Service 04) GBA Based Local Key Establishment Mechanism: 
(Service 05) Support for P-CSCF discovery for IMS local breakout 
(Service 06) Short Message Storage (SMS): 
(Service 07) Short Message Status Reports (SMSR): 
(Service 08) Support for SM-over-IP: 



Byte 


B1 


Coding: 


111 X xxxl 



4.5.3.3 EFiMPi (IMS private user identity) 

Logically: 001010123456789@test.3gpp.com 



Byte: 


B01 


B02 


B03 


B04 


BOS 


B06 


B07 


BOS 


B09 


B10 


Coding: 


80 


1D 


30 


30 


31 


30 


31 


30 


31 


32 




B11 


B12 


B13 


B14 


B15 


B16 


B17 


B18 


B19 


B20 


33 


34 


35 


36 


37 


38 


39 


40 


74 


65 


B21 


B22 


B23 


B24 


B25 


B26 


B27 


B28 


B29 


B30 


73 


74 


2E 


33 


67 


70 


70 


2E 


63 


6F 


B31 


B32 


B33 


B34 


B35 


B36 


B37 


B38 


B39 


B40 


6D 


FF 


FF 


FF 


FF 


FF 


FF 


FF 


FF 


FF 



4.5.3.4 EFdomain (Home Network Domain Name) 



Logically: test.3gpp.com 



Byte: 


B01 


B02 


B03 


B04 


BOS 


BOG 


B07 


B08 


B09 


B10 


Coding: 


80 


OD 


74 


65 


73 


74 


2E 


33 


67 


70 




B11 


B12 


B13 


B14 


B15 


B16 


B17 


B18 


B19 


B20 


70 


2E 


63 


6F 


6D 


FF 


FF 


FF 


FF 


FF 



4.5.3.5 EFiMPu (IMS public user identity) 

Record 1 : 

Logically: sip:001010123456789@ims.mnc246.mcc081. 3gppnetwork.org 



available 

not available 
not available 

not available 

not available 
available 

available 

available 
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Dyie. 


DU 1 


Rn9 


dUO 


Rfld 


RHR 
DUO 


DUD 


ROT 


RHA 
DUO 


Rno 

DU^ 


R1 n 

D 1 U 




on 


OO 


/ O 


oy 


/ u 


OM 


OU 


OU 


O 1 


ou 




D 1 1 


R1 9 
D 1 ^ 


R1 
D 1 O 


R1 d 

D 1 H' 


R1 '^ 
D 1 O 


R1R 

D 1 Q 


R17 
D 1 f 


D 1 O 


R1Q 

D 1 9 


R9n 

D^U 




O 1 


oU 


O 1 




OO 


04 


OO 


OD 


Q7 
O/ 


OO 






R99 


R91 


R9d 


R9<i 


R9f^ 


R97 


R9ft 
D^O 


R9Q 

D^9 


DOU 








fiQ 


fiD 


/ o 


2E 


fiD 


fiE 


fi*^ 






B31 


832 


B33 


B34 


B35 


B36 


B37 


B38 


B39 


B40 




34 


36 


2E 


6D 


63 


63 


30 


38 


31 


2E 




B41 


B42 


B43 


B44 


B45 


B46 


B47 


B48 


B49 


B50 




33 


67 


70 


70 


6E 


65 


74 


77 


6F 


72 




B51 


B52 


B53 


B54 


B55 


B56 


B57 


B58 


B59 


B60 




6B 


2E 


6F 


72 


67 


FF 


FF 


FF 


FF 


FF 



Record 2: 



Logically: sip:+l 1234567890@test.3gpp.com 



Byte: 


B01 


B02 


B03 


B04 


B05 


B06 


B07 


BOB 


B09 


BIO 


Coding: 


80 


1E 


73 


69 


70 


3A 


2B 


31 


31 


32 




B11 


B12 


B13 


B14 


B15 


B16 


B17 


BIS 


B19 


B20 




33 


34 


35 


36 


37 


38 


39 


30 


40 


74 




B21 


B22 


B23 


B24 


B25 


B26 


B27 


B28 


B29 


B30 




65 


73 


74 


2E 


33 


67 


70 


70 


2E 


63 




B31 


B32 


B33 


B34 


B35 


B36 


B37 


B38 


B39 


B40 




6F 


6D 


FF 


FF 


FF 


FF 


FF 


FF 


FF 


FF 




B41 


B42 


B43 


B44 


B45 


B46 


B47 


B48 


B49 


B50 




FF 


FF 


FF 


FF 


FF 


FF 


FF 


FF 


FF 


FF 




B51 


B52 


B53 


B54 


B55 


B56 


B57 


B58 


B59 


B60 




FF 


FF 


FF 


FF 


FF 


FF 


FF 


FF 


FF 


FF 



Record 3: 



Logically: sip: user@test.3gpp.com 



Byte: 


B01 


B02 


B03 


B04 


B05 


B06 


B07 


B08 


B09 


BIO 


Coding: 


80 


16 


73 


69 


70 


3A 


75 


73 


65 


72 




B11 


B12 


B13 


B14 


B15 


B16 


B17 


B18 


B19 


B20 




40 


74 


65 


73 


74 


2E 


33 


67 


70 


70 




B21 


B22 


B23 


B24 


B25 


B26 


B27 


B28 


B29 


B30 




2E 


63 


6F 


6D 


FF 


FF 


FF 


FF 


FF 


FF 




B31 


B32 


B33 


B34 


B35 


B36 


B37 


B38 


B39 


B40 




FF 


FF 


FF 


FF 


FF 


FF 


FF 


FF 


FF 


FF 




B41 


B42 


B43 


B44 


B45 


B46 


B47 


B48 


B49 


B50 




FF 


FF 


FF 


FF 


FF 


FF 


FF 


FF 


FF 


FF 




B51 


B52 


B53 


B54 


B55 


B56 


B57 


B58 


B59 


B60 




FF 


FF 


FF 


FF 


FF 


FF 


FF 


FF 


FF 


FF 



4.5.3.6 EFp-cscF (P-CSCF ADDRESS) 

Logically: 

Address Type: FQDN 

P-CSCF Address: pcscfl.anyims.test.3gpp.com 
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Byte: 


DU 1 




Rn'% 

DUO 




RHR 
DUO 


DUD 


DUf 


RHA 
DUO 


Rno 

DU^ 


Rin 

D 1 U 


OnHinn ■ 








70 




7'^ 






'^1 


2E 




B11 


B12 


B13 


B14 


B15 


B16 


B17 


B18 


B19 


B20 


61 


6E 


79 


69 


6D 


73 


2E 


74 


65 


73 


821 


B22 


B23 


B24 


B25 


B26 


B27 


B28 


B29 


B30 


74 


2E 


33 


67 


70 


70 


2E 


63 


6F 


6D 


B31 


B32 


B33 


B34 


B35 


B36 


B37 


B38 


B39 


B40 


FF 


FF 


FF 


FF 


FF 


FF 


FF 


FF 


FF 


FF 



Note: This EF does not apply for 3GPP and shall not be used by a terminal using a 3GPP access network or a 3GPP 
Interworking WLAN. 



4.5.3.7 EFsMs (Short Message Service) 

At least 10 records. 

All records shall be empty. 

Logically: Status byte set to empty. 

Record 1-x (x>10): 



Byte: 


B1 


B2 


B3 


B4 


B5 


B6 


B7 


B8 


B9 


BIO 


B11 


B12 




B176 


Coding: 


00 


FF 


FF 


FF 


FF 


FF 


FF 


FF 


FF 


FF 


FF 


FF 




FF 



4.5.3.8 EFsMSR (Short message status reports) 

This EF shall contain as many records as EFsms- 
All records shall be empty. 

Logically: Status byte set to empty. 



Record 1-x (x>10): 



Byte: 


B01 


B02 


B03 


B04 


BOS 


B06 


B07 


B08 


B09 


BIO 


Coding: 


00 


FF 


FF 


FF 


FF 


FF 


FF 


FF 


FF 


FF 




B11 


B12 


B13 


B14 


B15 


B16 


B17 


B18 


B19 


B20 


FF 


FF 


FF 


FF 


FF 


FF 


FF 


FF 


FF 


FF 


B21 


B22 


B23 


B24 


B25 


B26 


B27 


B28 


B29 


B30 


FF 


FF 


FF 


FF 


FF 


FF 


FF 


FF 


FF 


FF 



4.5.3.9 EFsMSP (Short message service parameters) 

Logically: 
Record 1: 

Record length: 28 bytes 

Parameter Indicators: 

TP-Destination Address: Parameter absent 
TS-Service Centre Address: Parameter present 
TP-Protocol Identifier: Parameter absent 
TP-Data Coding Scheme: Parameter absent 
TP- Validity Period: Parameter absent 

TS-Service Centre Address: 

TON: International Number 

NPI: "ISDN / telephone numbering plan" 

Dialled number string: " 1 12233445566778" 
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Byte: 


B1 


B2 


B3 




B13 


B14 


B15 


B16 


B17 


B18 


B19 


B20 


B21 


B22 


B23 


Coding: 


FD 


FF 


FF 




FF 


09 


91 


11 


22 


33 


44 


55 


66 


77 


F8 




B24 


B25 


B26 


B27 


B28 






















FF 


FF 


FF 


FF 


FF 























All other records shall be empty. 



4.5.3.10 EFsMss (SMS Status) 

Logically: Last used TP-MR set to"00". 

Memory capacity available (flag unset bl="l"). 



Byte: 


B1 


B2 


Coding: 


00 


FF 



4.5.4 Default values at DF_TELECOM 

4.5.4.1 EFpsisMsc (Public Service Identity of the SM-SC) 

1 record only. 



Logically: 
Record 1: 

Public Service Identity of the SM-SC: tel:+ 112233445566778 



Byte: 


B01 


B02 


B03 


B04 


B05 


B06 


B07 


BOS 


B09 


BIO 


Coding: 


80 


14 


74 


65 


6C 


3A 


2B 


31 


31 


32 




811 


B12 


B13 


B14 


B15 


B16 


B17 


B18 


B19 


B20 


32 


33 


33 


34 


34 


35 


35 


36 


36 


37 


B21 


B22 


B23 


B24 


B25 


B26 


B27 


B28 




Bxx 


37 


38 


FF 


FF 


FF 


FF 


FF 


FF 




FF 



5 Subscription related tests 

5.1 IMSI/TMSI handling 

5.1 .1 UE identification by short IMSI 

5.1 .1 .1 Definition and applicability 

The IMSI is used for unique identification of the UE by UTRAN/ a GERAN. The IMSI is stored in the USIM and read 
during the UICC-Terminal initialisation procedure. 

5.1 .1 .2 Conformance requirement 

After successful completion of the RRC Connection Establishment procedure (in case of Terminals accessing UTRAN) 
respectively after receipt of an IMMEDIATE ASSIGNMENT message (in case of a Terminal accessing a GERAN) the 
UE shall send PAGING RESPONSE containing the IMSI of the USIM, which is less than the maximum length. 
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Reference: 

- TS 31.102 [4], subclauses 5.1.1 and 5.2.2; 

- TS 24.008 [16], subclause 10.5.1.4; 

- ETSI TS 102 221 [5], subclause 14.1.1. 

5.1.1.3 Test purpose 

1) To verify that the Terminal uses the IMSI of the USIM. 

2) To verify that the Terminal can handle an IMSI of less than the maximum length. 

3) To verify that the READ EFjmsi conmiand is performed correctly by the terminal 

5.1.1.4 Method of test 

5.1.1.4.1 Initial conditions 

The USS (in case of a Terminal accessing UTRAN) / SS (in case of a Terminal accessing a GERAN) transmits on the 
BCCH, with the following network parameters: 

- Attach/detach: disabled. 

- LAI (MCC/MNC/LAC): 246/081/0001. 
Access control: unrestricted. 

The default UICC is installed into the Terminal and the UE is powered on. 

In case of a Terminal accessing UTRAN "Expected Sequence A" and in case of a Terminal accessing a GERAN 
"Expected Sequence B" shall be performed. 

5.1.1.4.2 Procedure 

Expected Sequence A: 

a) The USS sends PAGING TYPE 1 to the UE using the IMSI stored in the USIM. 

b) After receipt of a RRC CONNECTION REQUEST from the UE, the USS sends RRC CONNECTION SETUP 
to the UE, followed by RRC CONNECTION SETUP COMPLETE sent by the UE to the USS. 

c) After receipt of a PAGING RESPONSE from the UE, the USS sends RRC CONNECTION RELEASE to the 
UE, followed by RRC CONNECTION RELEASE COMPLETE sent by the UE to the USS. 

Expected Sequence B: 

a) The SS sends PAGING REQUEST to the UE using the IMSI stored in the USIM. 

b) After receipt of a CHANNEL REQUEST from the UE, the SS sends IMMEDIATE ASSIGNMENT to the UE. 

c) After receipt of a PAGING RESPONSE from the UE, the SS sends CHANNEL RELEASE to the UE. 

5.1.1.5 Acceptance criteria 

After step b) the UE shall send PAGING RESPONSE to the USS/SS containing the IMSI stored in the USIM. 
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5.1 .2 UE identification by short IMSI using a 2 digit MNC 



5.1.2.1 



Definition and applicability 



In some networks the IMSI identifying the UTRAN/ GERAN can be consistence of a 2 digit MNC. The IMSI is stored 
in the USIM and read during the UICC-Terminal initiaUsation procedure. 



5.1.2.2 



Conformance requirement 



After successful completion of the RRC Connection Establishment procedure (in case of Terminals accessing UTRAN) 
respectively after receipt of an IMMEDIATE ASSIGNMENT message (in case of a Terminal accessing a GERAN) the 
UE shall send PAGING RESPONSE containing the IMSI of the USIM. 

Reference: 

- TS 31.102 [4], subclause 4.2.18; 

- TS 24.008 [16], subclause 10.5.1.4. 

5.1.2.3 Test purpose 

1) To verify that the Terminal can handle an IMSI consistence of a 2 digit MNC. 

5.1.2.4 Method of test 



5.1.2.4.1 



Initial conditions 



The USS (in case of a Terminal accessing UTRAN) / SS (in case of a Terminal accessing a GERAN) transmits on the 
BCCH, with the following network parameters: 

- Attach/detach: disabled. 

- LAI (MCC/MNC/LAC): 246/8 1/0001 . 

- Access control: unrestricted. 

The default UICC is used with the following exception: 
EFloci (Location Information) 
Logically: 



LAI-MCC: 
LAI-MNC: 
LAI-LAC: 
TMSI: 



246 
81 

0001 

"FF .. FF" 



Coding: 
Hex 



B1 
FF 



B2 
FF 



B3 
FF 



84 
FF 



B5 
42 



B6 
F6 



87 
18 



B8 
00 



B9 
01 



BIO 
FF 



B11 
00 



EFiMsi(IMSI) 

Logically: 



246813579 



Coding: 
Hex 



B1 
05 



B2 
29 



B3 
64 



B4 
18 



B5 
53 



B6 
97 



B7 
FF 



B8 
FF 



B9 
FF 



EFad (Administrative Data) 

Logically: Normal operation 

OEM to be deactivated by the Terminal 
MNC: 2 digit 
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Coding: B1 B2 B3 B4 
Hex 00 00 00 02 

The UICC is installed into the Terminal and the UE is powered on. 

In case of a Terminal accessing UTRAN "Expected Sequence A" and in case of a Terminal accessing a GERAN 
"Expected Sequence B" shall be performed. 

5.1.2.4.2 Procedure 

Expected Sequence A: 

a) The USS sends PAGING TYPE 1 to the UE using the IMSI stored in the USIM. 

b) After receipt of a RRC CONNECTION REQUEST from the UE, the USS sends RRC CONNECTION SETUP 
to the UE, followed by RRC CONNECTION SETUP COMPLETE sent by the UE to the USS. 

c) After receipt of a PAGING RESPONSE from the UE, the USS sends RRC CONNECTION RELEASE to the 
UE, followed by RRC CONNECTION RELEASE COMPLETE sent by the UE to the USS. 

Expected Sequence B: 

a) The SS sends PAGING REQUEST to the UE using the IMSI stored in the USIM. 

b) After receipt of a CHANNEL REQUEST from the UE, the SS sends IMMEDIATE ASSIGNMENT to the UE. 

c) After receipt of a PAGING RESPONSE from the UE, the SS sends CHANNEL RELEASE to the UE. 

5. 1 .2.5 Acceptance criteria 

After step b) the UE shall send PAGING RESPONSE to the USS/SS containing the IMSI stored in the USIM. 

5.1 .3 UE identification by "short" TMSI 

5.1 .3.1 Definition and applicability 

The TMSI is temporarily used for identification of the UE by UTRAN/ a GERAN. It will have been previously 
assigned by the network. The TMSI is stored in the USIM by the Terminal and read during the USIM-Terminal 
initialisation procedure. 

NOTE: According to TS 23.003 [14], subclause 2.4, a TMSI always consists of 8 digits (4 bytes). With this tests 
the handling of a TMSI with leading zeros will be tested. The term "short" TMSI is used in order to 
distinguish between the tests as defined in subclauses 5.1.3 and 5.1.4. 

5.1 .3.2 Confornnance requirement 

After successful completion of the RRC Connection Establishment procedure (in case of Terminals accessing UTRAN) 
respectively after receipt of an IMMEDIATE ASSIGNMENT message (in case of a Terminal accessing a GERAN) the 
UE shall send PAGING RESPONSE containing the TMSI of the USIM. According to subclause 10.3.1.17 in 
TS 25.331 [20] the TMSI has a fixed length of 32 bit (8 digits) when used inside the PAGING TYPE II PAGING 
REQUEST message. 

Reference: 

- TS 31.102 [4], subclauses 5.1.1 and 5.2.2; 

- TS 24.008 [16], subclause 10.5.1.4. 

- TS 25.331 [20], subclause 10.3.1.17 
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5.1.3.3 Test purpose 

1) To verify that the Terminal uses the TMSI stored in the USIM. 

2) To verify that the Terminal can handle a TMSI of less than maximum length. 

5.1.3.4 Method of test 

5.1 .3.4.1 Initial conditions 

The USS (in case of a Terminal accessing UTRAN) / SS (in case of a Terminal accessing a GERAN) transmits on the 
BCCH, with the following network parameters: 

- Attach/detach: disabled. 

- LAI (MCC/MNC/LAC): 246/081/0001. 

- Access control: unrestricted. 

The default UICC is used with the following exception: 

EFloci (Location Information) 

Logically: LAI-MCC: 246 

LAI-MNC: 081 

LAI-LAC: 0001 

TMSI: "00002143" 

Coding: B1 B2 B3 B4 B5 B6 B7 B8 B9 B10 B11 

Hex 00 00 21 43 42 16 80 00 01 FF 00 

The UICC is installed into the Terminal and the UE is powered on. 

In case of a Terminal accessing UTRAN "Expected Sequence A" and in case of a Terminal accessing a GERAN 
"Expected Sequence B" shall be performed. 

5.1.3.4.2 Procedure 

Expected Sequence A: 

a) The USS sends PAGING TYPE 1 to the UE using the TMSI stored in the USIM matching the required length of 
8 digits. 

b) After receipt of a RRC CONNECTION REQUEST from the UE, the USS sends RRC CONNECTION SETUP 
to the UE, followed by RRC CONNECTION SETUP COMPLETE sent by the UE to the USS. 

c) After receipt of a PAGING RESPONSE from the UE, the USS sends RRC CONNECTION RELEASE to the 
UE, followed by RRC CONNECTION RELEASE COMPLETE sent by the UE to the USS. 

Expected Sequence B : 

a) The SS sends PAGING REQUEST to the UE using the TMSI stored in the USIM matching the required length 
of 8 digits. 

b) After receipt of a CHANNEL REQUEST from the UE, the SS sends IMMEDIATE ASSIGNMENT to the UE. 

c) After receipt of a PAGING RESPONSE from the UE, the SS sends CHANNEL RELEASE to the UE. 

5.1 .3.5 Acceptance criteria 

After step b) the UE shall send PAGING RESPONSE to the USS/SS containing the TMSI stored in the USIM. 



ETSI 



3GPP TS 31.121 version 10.2.1 Release 10 



61 



ETSI TS 131 121 VI 0.2.1 (2011-11) 



5.1 .4 UE identification by "long" TMSI 

5.1 .4.1 Definition and applicability 

The TMSI is temporarily used for identification of the UE by UTRAN/ a GERAN. It will have been previously 
assigned by the network. The TMSI is stored in the USIM by the Terminal and read during the USIM-Terminal 
initialisation procedure. 

NOTE: According to TS 23.003 [14], subclause 2.4, a TMSI always consists of 8 digits (4 bytes). With this tests 
the handling of a new assigned TMSI will be tested. The term "long" TMSI is used in order to distinguish 
between the tests as defined in subclauses 5.1.3 and 5.1.4. 

5.1 .4.2 Conformance requirement 

After successful completion of the RRC Connection Establishment procedure (in case of Terminals accessing UTRAN) 
respectively after receipt of an IMMEDIATE ASSIGNMENT message (in case of a Terminal accessing a GERAN) the 
UE shall send PAGING RESPONSE containing the correct TMSI stored in the USIM. 

According to subclause 10.3.1.17 in TS 25.331 [20] the TMSI has a fixed length of 32 bit (8 digits) when used inside 
the PAGING TYPE 1/P AGING REQUEST message. 

Reference: 

- TS 31.102 [4], subclauses 5.1.1 and 5.2.2; 

- TS 24.008 [16], subclause 10.5.1.4. 

- TS 25.331 [20], subclause 10.3.1.17 

5.1.4.3 Test purpose 

1) To verify that the Terminal uses the TMSI stored in the USIM. 

2) To verify that the Terminal can handle a TMSI of maximum length. 

3) To verify that the Terminal does not respond to page requests containing a previous TMSI. 

5.1.4.4 Method of test 
5.1 .4.4.1 Initial conditions 

Prior to this test, the Terminal shall have been operated with a USIM containing TMSI "2143". This may be achieved 
by executing the previous test (5.1.3) prior to this test. Only under this condition will test purpose 3) be verified. 

The USS (in case of a Terminal accessing UTRAN) / SS (in case of a Terminal accessing a GERAN) transmits on the 
BCCH, with the following network parameters: 

- Attach/detach: disabled. 

- LAI (MCC/MNC/LAC): 246/081/0001. 

- Access control: unrestricted. 
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The default UICC is used with the following exception: 

EFloci (Location Information) 

Logically: LAI-MCC: 246 

LALMNC: 081 
LALLAC: 0001 
TMSI: "21430000" 

Coding: B1 B2 B3 84 B5 B6 B7 B8 B9 B10 B11 

Hex 21 43 00 00 42 16 80 00 01 FF 00 

The UICC is installed into the Terminal and the UE is powered on. 

In case of a Terminal accessing UTRAN "Expected Sequence A" and in case of a Terminal accessing a GERAN 
"Expected Sequence B" shall be performed. 

5.1 .4.4.2 Procedure 

Expected Sequence A: 

a) The USS sends PAGING TYPE 1 to the UE using the TMSI "00002143". 

b) The USS sends PAGING TYPE 1 to the UE using the TMSI stored in the USIM. 

c) After receipt of a RRC CONNECTION REQUEST from the UE, the USS sends RRC CONNECTION SETUP 
to the UE, followed by RRC CONNECTION SETUP COMPLETE sent by the UE to the USS. 

d) After receipt of a PAGING RESPONSE from the UE, the USS sends RRC CONNECTION RELEASE to the 
UE, followed by RRC CONNECTION RELEASE COMPLETE sent by the UE to the USS. 

Expected Sequence B: 

a) The SS sends PAGING REQUEST to the UE using the TMSI "00002143". 

b) The SS sends PAGING REQUEST to the UE using the TMSI stored in the USIM. 

c) After receipt of a CHANNEL REQUEST from the UE, the SS sends IMMEDIATE ASSIGNMENT to the UE. 

d) After receipt of a PAGING RESPONSE from the UE, the SS sends CHANNEL RELEASE to the UE. 

5. 1 .4.5 Acceptance criteria 

1) After step a) the UE shall not respond to the PAGING TYPE 1 respectively to the PAGING REQUEST. 

2) After step c) the UE shall send PAGING RESPONSE to the USS/ SS containing the TMSI stored in the USIM. 

5.1 .5 UE identification by long IMSI, TMSI updating and key set identifier 
assignment 

5.1 .5.1 Definition and applicability 

The IMSI and TMSI are used for identification of the UE by UTRAN/ a GERAN. They are read from the USIM during 
the USIM-Terminal initialisation procedure. Within the authentication procedure the UTRAN sends a key set identifier 
respectively a GERAN sends a ciphering key sequence number to the UE. In addition the network may allocate a new 
TMSI to the UE. Key set identifier and TMSI are stored in the USIM after UTRAN call termination and/or at a 3G 
session termination. Ciphering key sequence number and TMSI are stored in the USIM after GERAN call termination 
and/or at a 3G session termination. 

NOTE: According to TS 24.008 [16] the term KSI may be used instead of the term ciphering key sequence 
number which is used inside the MM message AUTHENTICATION REQUEST. 
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5.1 .5.2 Conformance requirement 

1) After successful completion of the RRC Connection Establishment procedure (in case of Terminals accessing 
UTRAN) respectively after receipt of an IMMEDIATE ASSIGNMENT message (in case of a Terminal 
accessing a GERAN) the UE shall send PAGING RESPONSE containing the correct IMSI stored in the USIM. 

Reference: 

- TS 31.102 [4], subclauses 5.1.1 and 5.2.2; 

- TS 24.008 [16], subclause 10.5.1.4. 

2) After call termination the USIM shall contain the key set identifier (ciphering key sequence number) and TMSI 
received by the UE during the authentication and TMSI reallocation procedures. 

Reference: 

- TS 31.102 [4], subclauses 5.1.2, 5.2.5 and 5.2.6; 

- TS 21.111 [19], subclause 10.1. 

- TS 24.008 [16], subclause 4.3.2.4. 

3) After call termination the Terminal shall have updated EFLOCI. 
Reference: 

- ETSI TS 102 221 [5], subclause 14.1.2. 

5.1.5.3 Test purpose 

1) To verify that the Terminal uses the IMSI stored in the USIM. 

2) To verify that the Terminal does not respond to page requests containing a previous IMSI. 

3) To verify that the Terminal can handle an IMSI of maximum length. 

4) To verify that the Terminal correctly updates the key set identifier respectively the ciphering key sequence 
number at call termination. 

5) To verify that the Terminal correctly updates the TMSI at call termination. 

6) To verify that the UPDATE EFloci conmiand is performed correctly by the terminal 

5.1.5.4 Method of test 
5.1 .5.4.1 Initial conditions 

Prior to this test, the Terminal shall have been operated with a USIM containing IMSI "2460813579". This may be 
achieved by executing the previous test (5.1.4) prior to this test. Only under this condition will test purpose 2) be 
verified. 

The USS (in case of a Terminal accessing UTRAN) / SS (in case of a Terminal accessing a GERAN) transmits on the 
BCCH, with the following network parameters: 

- Attach/detach: disabled. 

- LAI (MCC/MNC/LAC): 246/081/0001. 

- Access control: unrestricted. 

The default UICC is used with the following exception: 
EFiMsi (IMSI) 

Logically: 246081111111111 
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Coding: B1 82 B3 B4 85 B6 B7 88 B9 

Hex 08 29 64 80 11 11 11 11 11 

EFkc (GSM Ciphering Key Kc) 

Logically: Ciphering key Kc: xx 

Ciphering key sequence number n: 01 

Coding: B1 82 B3 B4 85 B6 B7 88 B9 

Hex XX XX XX xx xx xx xx xx 01 

The UICC is installed into the Terminal and the UE is powered on. 

In case of a Terminal accessing UTRAN "Expected Sequence A" and in case of a Terminal accessing a GERAN 
"Expected Sequence B" shall be performed. 

5.1.5.4.2 Procedure 

Expected Sequence A: 

a) The USS sends PAGING TYPE 1 to the UE using the IMSI "2460813579". 

b) The USS sends PAGING TYPE 1 to the UE using the IMSI stored in the USIM. 

c) After receipt of a RRC CONNECTION REQUEST from the UE, the USS sends RRC CONNECTION SETUP 
to the UE, followed by RRC CONNECTION SETUP COMPLETE sent by the UE to the USS. 

d) After receipt of a PAGING RESPONSE from the UE, the USS sends AUTHENTICATION REQUEST to the 
UE containing Key Set Identifier KSI (ciphering key sequence number) set to binary 010. 

e) After receipt of AUTHENTICATION RESPONSE from the UE and subsequent completion of the security 
procedure on RRC, the USS sends TMSI REALLOCATION COMMAND to the UE containing TMSI 
"32547698". 

f) Within 5 s after receipt of TMSI REALLOCATION COMPLETE from the UE, the USS sends RRC 
CONNECTION RELEASE to the UE. 

g) To allow examination of the values in the USIM after connection termination the UE shall not be soft powered 
down. If the test is performed with a USIM simulator, the simulation is stopped. If the test is performed with a 
USIM, the UICC is removed without soft powering down the UE. If this is not possible, the power supply of the 
Terminal is removed and then the UICC removed. 

Expected sequence B: 

a) The SS sends PAGING REQUEST to the UE using the IMSI "2460813579". 

b) The SS sends PAGING REQUEST to the UE using the IMSI stored in the USIM. 

c) After receipt of a CHANNEL REQUEST from the UE, the SS sends IMMEDIATE ASSIGNMENT to the UE. 

d) After receipt of a PAGING RESPONSE from the UE, the SS sends AUTHENTICATION REQUEST to the UE 
containing ciphering key sequence number set to binary 010. 

e) After receipt of AUTHENTICATION RESPONSE from the UE, the SS sends TMSI REALLOCATION 
COMMAND to the UE containing TMSI "32547698". 

f) Within 5 s after receipt of TMSI REALLOCATION COMPLETE from the UE, the SS sends CHANNEL 
RELEASE to the UE. 

g) To allow examination of the values in the USIM after connection termination the UE shall not be soft powered 
down. If the test is performed with a USIM simulator, the simulation is stopped. If the test is performed with a 
USIM, the UICC is removed without soft powering down the UE. If this is not possible, the power supply of the 
Terminal is removed and then the UICC removed. 
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5.1.5.5 Acceptance criteria 

1) After step a) the UE shall not respond to the PAGING TYPE II PAGING REQUEST. 

2) After step c) the UE shall send PAGING RESPONSE to the USS/SS containing the IMSI stored in the USIM. 

3) After step e) the UE shall send TMSI REALLOCATION COMPLETE to the USS/SS. 

4) After step g) the USIM shall contain the following values: 

EFloci (Location Information) 

Logically: LAI-MCC: 246 

LAI-MNC: 081 
TMSI: "32547698" 



Coding: B1 
Hex 32 



B2 
54 



B3 
76 



84 
98 



B5 
42 



B6 
16 



87 
80 



B8 

XX 



B9 

XX 



B10 

XX 



B11 
00 



In case of a Terminal accessing UTRAN: 

EFxeys (Ciphering and Integrity Keys) 

Logically: Key Set Identifier KSI: 

Ciphering Keys CK: 
Integrity Keys IK: 



02 

XX (result of the authentication algorithm) 
XX (result of the authentication algorithm) 



Coding: 
Hex 



B1 
02 



B2 

XX 



B3 

XX 



B16 

XX 



B17 

XX 



B18 

XX 



B31 

XX 



B32 

XX 



B33 

XX 



In case of a Terminal accessing a GERAN: 
EFkc (GSM Ciphering Key Kc) 



Logically: Ciphering key Kc: xx (result of the authentication algorithm) 

Ciphering key sequence number n: 02 

B1 B2 B3 B4 B5 B6 B7 B8 B9 

XX XX XX XX Xx XX XX XX 02 



Coding: 
Hex 



5.1 .6 UE identification by short IMSI when accessing E-UTRAN/EPC 

5.1 .6.1 Definition and applicability 

Paging for EPS services using IMSI is an abnormal procedure used for error recovery in the network. The IMSI is used 
for unique identification of the UE by an E-UTRAN/EPC if there is no GUTI available. The IMSI is stored in the USIM 
and read during the UICC-Terminal initialisation procedure. 

5.1 .6.2 Conformance requirement 

Only after reception of a Paging message containing the IMSI stored in the USIM the UE shall send the 
RRCConnectionRequest message. 

Reference: 

- TS 31.102 [4], subclauses 5.1.1 and 5.2.2; 

- ETSI TS 102 221 [5], subclause 14.1.1; 

- TS 24.301 [26], subclause 5.6.2.2.2. 
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5.1.6.3 Test purpose 

1) To verify that the Terminal uses the IMSI of the USIM. 

2) To verify that the Terminal can handle an IMSI of less than the maximum length. 

3) To verify that the READ EFimsi command is performed correctly by the terminal. 

4) To verify that the terminal does not respond to a Paging message containing an IMSI not stored in the USIM. 

5.1.6.4 Method of test 

5.1 .6.4.1 Initial conditions 

The E-USS transmits on the BCCH, with the following network parameters: 

- TAI (MCC/MNC/TAC): 246/081/0001. 

- Access control: unrestricted. 

The default E-UTRAN UICC is installed into the Terminal and the UE is powered on. 

5.1.6.4.2 Procedure 

a) The UE performs Attach procedure to E-USS. 

b) The E-USS sends Paging to the UE using the IMSI 24608122222. 

c) The E-USS sends Paging to the UE using the IMSI stored in the USIM. 

d) After receipt of a RRCConnectionRequest message from the UE, the E-USS sends RRCConnectionSetup 
message to the UE, followed by RRCConnectionSetupComplete sent by the UE to the E-USS. 

e) After the EPS attach procedure the E-USS sends RRCConnectionRelease to the UE. 

5. 1 .6.5 Acceptance criteria 

1) After step b) the UE shall not send RRCConnectionRequest to the E-USS. 

2) After step c) the UE shall send RRCConnectionRequest to the E-USS. 

3) After step d) the UE performs the EPS attach procedure. 

5.1 .7 UE identification by short IMSI using a 2 digit MNC when accessing 
E-UTRAN/EPC 

5.1 .7.1 Definition and applicability 

In some networks the IMSI identifying the E-UTRAN/EPC can be consistence of a 2 digit MNC. Paging for EPS 
services using IMSI is an abnormal procedure used for error recovery in the network. The IMSI is used for unique 
identification of the UE by an E-UTRAN/EPC if there is no GUTI available. The IMSI is stored in the USIM and read 
during the UICC-Terminal initialisation procedure. 

5.1 .7.2 Conformance requirement 

Only after reception of a Paging message containing the IMSI stored in the USIM the UE shall send the 
RRCConnectionRequest message. 

Reference: 
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- TS 31.102 [4], subclauses 5.1.1 and 5.2.2; 

- ETSI TS 102 221 [5], subclause 14.1.1; 

- TS 24.301 [26], subclause 5.6.2.2.2. 

5.1.7.3 Test purpose 

1) To verify that the Terminal uses the IMSI of the USIM. 

2) To verify that the Terminal can handle an IMSI consistence of a 2 digit MNC. 

3) To verify that the READ EFjmsi conmiand is performed correctly by the terminal. 

4) To verify that the terminal does not respond to a Paging message containing an IMSI not stored in the USIM. 

5.1.7.4 Method of test 

5.1 .7.4.1 Initial conditions 

The E-USS transmits on the BCCH, with the following network parameters: 

- TAI (MCC/MNC/TAC): 246/81/0001. 

- Access control: unrestricted. 

The default UICC is used with the following exception: 
EFiMsi (IMSI) 

Logically: 246813579 

Coding: B1 B2 B3 B4 B5 B6 B7 B8 B9 
Hex 05 29 64 18 53 97 FF FF FF 

EFad (Administrative Data) 

Logically: Normal operation 

OFM to be deactivated by the Terminal 
MNC: 2 digit 

Coding: B1 B2 B3 B4 
Hex 00 00 00 02 

The UICC is installed into the Terminal and the UE is powered on. 

5.1.7.4.2 Procedure 

a) The UE performs Attach procedure to E-USS. 

b) The E-USS sends Paging to the UE using the IMSI 24608122222. 

c) The E-USS sends Paging to the UE using the IMSI stored in the USIM. 

d) After receipt of a RRCConnectionRequest message from the UE, the E-USS sends RRCConnectionSetup 
message to the UE, followed by RRCConnectionSetupComplete sent by the UE to the E-USS. 

e) After the EPS attach procedure the E-USS sends RRCConnectionRelease to the UE. 

5.1 .7.5 Acceptance criteria 

1) After step b) the UE shall not send RRCConnectionRequest to the E-USS. 
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2) After step c) the UE shall send RRCConnectionRequest to the E-USS. 

3) After step d) the UE performs the EPS attach procedure. 
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5.1 .8 UE identification after changed IMSI with service "EMM Information" 
not available 

The attach procedure is used to attach for packet services in EPS. With a successful attach procedure, a context is 
established for the UE in the MME, and a default bearer is established between the UE and the PDN GW, thus enabling 
always-on IP connectivity to the UE. The network may also initiate the activation of dedicated bearers as part of the 
attach procedure. 

5.1 .8.2 Conformance requirement 

The following EMM parameters shall be stored on the USIM if the corresponding file is present: 

- GUTI; 

- last visited registered TAI; 

- EPS update status. 

If the corresponding file is not present on the USIM, these EMM parameters except allowed CSG list are stored in a 
non- volatile memory in the ME together with the IMSI from the USIM. These EMM parameters can only be used if the 
IMSI from the USIM matches the IMSI stored in the non- volatile memory; else the UE shall delete the EMM 
parameters. 

Reference: 

- TS 31.102 [4], subclauses 5.1.1 and 5.2.2; 

- TS 24.301 [26], subclause 5.5.1.2.1, 5.5.1.2.2, 5.5.1.2.4 and Annex C. 

5.1.8.3 Test purpose 

1) To verify that UE deletes existing EMM parameters from the UE's non- volatile memory in case a different IMSI 
is activated. 

2) To verify that UE includes the IMSI stored in the USIM during the attach procedure. 

5.1.8.4 Method of test 

5.1 .8.4.1 Initial conditions 

The E-USS transmits on the BCCH, with the following network parameters: 

- TAI (MCC/MNC/TAC): 246/081/0001. 

- Access control: unrestricted. 

The default UICC (without the service "EMM Information") is installed into the Terminal and the UE is powered on. 

5.1.8.4.2 Procedure 

a) The UE is switched on. 

b) The UE requests RRC Connection and therefore performs EPS Attach procedure to the E-USS. The E-USS 
sends AttachAccept with the following values: 

GUTI: "24608100010266345678" 
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TAI (MCC/MNC/TAC):246/081/0001 

c) The UE send AttachComplete. 

d) The E-USS requests the release of the RRC Connection. 

e) The UE is switched off. 

f) A new UICC with the following configuration is activated: 

The default UICC with the following exception: The IMSI is set to "246081222233333". 

g) The Terminal is switched on. 

h) The UE requests RRC Connection and therefore performs EPS Attach procedure to the E-USS. 

5.1.8.5 Acceptance criteria 

1) After step a) the UE shall read EFust- 

2) During step h) the UE shall include the IMSI "246081222233333", but no GUTI nor TAI in the AttachRequest 

message. 



5.1 .9 UE identification by GUTI when using USIM with service "EMM 
Information" not available 

The attach procedure is used to attach for packet services in EPS. With a successful attach procedure, a context is 
established for the UE in the MME, and a default bearer is established between the UE and the PDN GW, thus enabling 
always-on IP connectivity to the UE. The network may also initiate the activation of dedicated bearers as part of the 
attach procedure. 

5.1 .9.2 Conformance requirement 

The following EMM parameters shall be stored on the USIM if the corresponding file is present: 

- GUTI; 

- last visited registered TAI; 

- EPS update status. 

If the corresponding file is not present on the USIM, these EMM parameters except allowed CSG list are stored in a 
non- volatile memory in the ME together with the IMSI from the USIM. These EMM parameters can only be used if the 
IMSI from the USIM matches the IMSI stored in the non- volatile memory; else the UE shall delete the EMM 
parameters. 

Reference: 

- TS 31.102 [4], subclauses 5.1.1 and 5.2.2; 

- TS 24.301 [26], subclause 5.5.1.2.1, 5.5.1.2.2, 5.5.1.2.4 and Annex C. 
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5.1.9.3 Test purpose 

1) To verify that UE stores the GUTI and the TAI in the UE's non- volatile memory. 

2) To verify that the UE uses the GUTI and the TAI from the UE's non- volatile memory during the attach procedure 
if the IMSI stored in the USIM has not changed. 

5.1.9.4 Method of test 

5.1 .9.4.1 Initial conditions 

The E-USS transmits on the BCCH, with the following network parameters: 

- TAI (MCC/MNC/TAC): 246/081/0001. 

- Access control: unrestricted. 

The default UICC (without the service "EMM Information") is installed into the Terminal and the UE is powered on. 

5.1.9.4.2 Procedure 

a) The UE is switched on. 

b) The UE requests RRC Connection and therefore performs EPS Attach procedure to the E-USS. The E-USS 
sends AttachAccept with the following values: 

GUTI: "24608100010266345699" 

TAI (MCC/MNC/TAC):246/081/0001 

c) The UE send Attache omplete. 

d) The E-USS requests the release of the RRC Connection. 

e) The UE is switched off. 

f) The default UICC remains in use. 

g) The Terminal is switched on. 

h) The UE requests RRC Connection and therefore performs EPS Attach procedure to the E-USS. 

5. 1 .9.5 Acceptance criteria 

1) After step a) the UE shall read EFust- 

2) During step h) the UE shall include the GUTI "24608100010266345699" and the TAI 246/081/0001 in the 

AttachRequest message. 

5.1.10 UE identification by GUTI when using USIM with service "EMM 
Information" available 

5.1 .1 0.1 Definition and applicability 

The attach procedure is used to attach for packet services in EPS. With a successful attach procedure, a context is 
established for the UE in the MME, and a default bearer is established between the UE and the PDN GW, thus enabling 
always-on IP connectivity to the UE. The network may also initiate the activation of dedicated bearers as part of the 
attach procedure. 
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5.1 .1 0.2 Conformance requirement 

The following EMM parameters shall be stored on the USIM if the corresponding file is present: 

- GUTI; 

- last visited registered TAI; 

- EPS update status. 

The presence and format of corresponding files on the USIM is specified in 3GPP TS 31.102 [4]. 
Reference: 

- TS 31.102 [4], subclauses 5.1.1 and 5.2.2; 

- TS 24.301 [26], subclause 5.5.1.2.1, 5.5.1.2.2, 5.5.1.2.4 and Annex C. 

5.1.10.3 Test purpose 

1) To verify that UE includes the GUTI and TAI stored in EFepsloci in the AttachRequest message. 

2) To verify that the EMM parameters GUTI, Last Registered TAI sent in the AttachAccept message and the related 
EPS Update Status are correctly stored on the USIM if the corresponding file is present. 

5.1.10.4 Method of test 
5.1 .1 0.4.1 Initial conditions 

The E-USS transmits on the BCCH, with the following network parameters: 

- TAI (MCC/MNC/TAC): 246/081/0002. 

- Access control: unrestricted. 

The default E-UTRAN UICC is is used with the following exceptions: 

EFepsnsc (EPS NAS Security Context) 

Logically: Key Set Identifier KSIasme: '0 1 ' 

ASME Key (KSIasme) : 32 byte key, any value 

Uplink NAS count: 00 

Downhnk NAS count: 01 

Identifiers of selected NAS 01 

integrity and encryption 

algorithm 



Coding: 


B1 


82 


B3 


B4 


B5 


B6 


B7 


B8 




B39 


Hex 


AO 


34 


80 


01 


01 


81 


20 


XX 




XX 


Coding: 


B40 


B41 


B42 


B43 


B44 


B45 


B46 


B47 


B48 


B49 


Hex 


82 


04 


00 


00 


00 


00 


83 


04 


00 


00 


Coding: 


B50 


B51 


B52 


B53 


B54 












Hex 


00 


01 


84 


01 


01 













5.1.10.4.2 Procedure 

a) The UE is switched on. 

b) The UE requests RRC Connection and therefore performs EPS Attach procedure to the E-USS. The E-USS 
sends AttachAccept with the following values: 

GUTI: "24608100010266436587" 
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TAI (MCC/MNC/TAC):246/081/0002 

c) The UE send AttachComplete. 

d) The E-USS requests the release of the RRC Connection. 

5.1.10.5 Acceptance criteria 

1) After step a) the UE shall read EFust and EFepsloci- 

2) During step b) the UE shall include the GUTI and the Last visited registered TAI contained in EFepsloci when 
sending the AttachRequest message. 

3) After step b) EFepsloci shall contain: 

Logically: GUTI: 24608100010266436587 

Last visited registered TAI: 246/081/0002 
EPS update status: updated 



Byte: 


B1 


B2 


B3 


B4 


B5 


B6 


B7 


B8 


B9 


BIO 


Hex: 


OB 


F6 


42 


16 


80 


00 


01 


02 


66 


43 




B12 


B13 


B14 


B15 


B16 


B17 


B18 










87 


42 


16 


80 


00 


02 


00 









B11 
65 



5.2 Access Control handling 

5.2.1 Access Control information handling 

5.2.1 .1 Definition and applicability 

Access Control allows restriction of call access attempts. All User Equipments are assigned to one out of ten randomly 
allocated classes, and optionally (for priority uses) also to one or more special categories. 

An Access Class of the special Categories is only valid in the HPLMN or HPLMN country. Otherwise, the randomly 
allocated class is used. 

The classes are progranmied on the USIM. The network controls which classes at any time may be barred. 
In addition, there is a separate mechanism for control of network access for emergency call attempts. 

5.2.1 .2 Conformance requirement 

1 . The Terminal shall read the access control value as part of the USIM-Terminal initialisation procedure, and 
subsequently adopt this value. 

Reference: 

- TS 31.102 [4], subclause 5.1.1. 

2. If the UE is a member of at least one access class which corresponds to the permitted classes as signalled over 
the air interface, and the access class is applicable in the serving network,access attempts are allowed . 
Otherwise access attempts are not allowed. 

3. If access class 10 is barred, then the Ues of classes 0-9 and the Terminals without UICCs shall not make 
emergency call attempts. 
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4. UE of classes 1 1 - 15 are not allowed to make emergency call attempts if access class 10 and the relevant 
access class(es) between 11 and 15 are barred. Otherwise, emergency call attempts are allowed irrespective of 
the conditions of access class 10. 

All options are shown in figure 5-1 and are referenced to the tests. 
Reference: 

- TS 22.01 1 [6], subclauses 4.3 and 4.4. 

5.2.1.3 Test purpose 

1) To verify that the Terminal reads the access control value as part of the USIM-Terminal initialisation procedure, 
and subsequently adopts this value. 

2) To verify that the UE controls its network access in accordance with its access control class and the conditions 
imposed by the serving network. 

The tests verify Terminal performance for the following: 

Tests (a) and (b) No UICC in Terminal. 

Tests (c) to (e) UE with access class to 9. 

Test (f) UE with access class 1 1 and 15 not in HPLMN, and 

UE with access class 12,13 and 14 not in HPLMN country. 

Test (g) and (h) UE with access class 11 and 15 in HPLMN, and 

UE with access class 12,13 and 14 in HPLMN country. 

Each of the above are tested against all relevant combinations of access control and emergency call bits signalled by the 
network, as shown in table 5-1. 

5.2.1.4 Method of test 

5.2.1 .4.1 Initial conditions 

The USS (in case of a Terminal accessing UTRAN)/ SS (in case of a GERAN Terminal) transmits on the BCCH, with 
the following network parameters: 

- Attach/detach: disabled. 

- LAI (MCC/MNC/LAC): MCC, MNC: see table 5-1, LAC="0001". 

- Access control: see table 5-1. 

- RACH: see table 5-1. 

The default UICC is installed in the Terminal containing IMSI and access control values as given in table 5-1 and the 
UE is powered on. 

NOTE: Depending on the initial value of the EFLocb the UE may perform a location update. This shall be 
accepted by the USS/SS. 

5.2.1.4.2 Coding details 

USIM IMSI EFiMsi: Data Field "6F 07" 

Logically: IMSI: "2460813579" 

Coding: B1 B2 B3 B4 B5 B6 B7 B8 B9 

Hex 06 21 64 80 31 75 F9 FF FF 
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Logically: IMSI: "24608135x9" 

Coding: B1 B2 B3 B4 B5 B6 B7 B8 B9 

Hex 06 21 64 80 31 x5 F9 FF FF 

Access Control class EFacc- Data field "6F 78" 
Reference: 

7) See TS 31.102 [4]. 
NETWORK (USS in case of a Terminal accessing UTRAN) 
Access Class Barred List in SIB 3 should be set as table 5.1a: 
Reference 

7) TS 25.331 clause 10.3.2.1 

NOTE: The first instance of the parameter corresponds to Access Class 0, the second to Access Class 1 and so on 
up to Access Class 15. 

NETWORK (SS in case of a Terminal accessing GERAN) 

RACK: As defined in TS 44.018 subclause 10.5.2.29. 

NOTE: TS 44.018 also apply for the Radio Resource management for UMTS (see TS 24.008, subclause 10.5.2). 

Octet 1 01111000 

Octet 2 0000 1000 

Octet 3 } 

Octet 4 } as table 5- lb 

5.2.1.4.3 Procedure 

a) Using the MMI or EMMI a normal call set-up is attempted. 

b) Using the MMI or EMMI an emergency call set-up is attempted. 

c) The test is repeated for each set of values in table 5-1. 

5.2.1 .5 Acceptance criteria 

After steps a) and b) the UE shall access the network, or shall make no access attempt, in accordance with table 5-1. 

NOTE 1 : For conformance testing, to limit testing, in tests (c), (d) and (e) it is only necessary that one of the access 
classes is tested. This access class may be chosen randomly. 

NOTE 2: In tables 5- la and 5- lb the following notation is used to describe the Access Class Barred IE: 
"O"=not barred, "1" =barred. 
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Table 5-1 a 



USIM 


Network 


Test Results 


IMSI 


RACH 
SIB3: 
Access 
Class 

List 


Informative: Cell 
Barred for: 


BCCH/ 
LAI 


Normal 
Call 


Emergency 
Call 


Access 
Class 


AC15- 
AC08 
AC07- 
ACOO 


Emergency Call 
Normal Call 


MCC 
MNC 




Test (a) 


No UlCC in 
Terrninal 


N/A 


0000 0100 
0000 0000 


Yes 
No 


234 
001 


No 


No 


Test (b) 

1 COL / 


No UlCC in 
Terminal 


N/A 


0000 0000 

w w w w w w w w 

0000 0000 


No 
No 


234 
001 


No 


Yes 


Test (c) 


"2460813579" 





0000 0100 
0000 0001 


Yes 

No, except for ACC 


246 
081 


No 


No 




"2460813579" 


1 


0000 0100 
0000 0010 


Yes 

No, except for ACC 


246 
081 


No 


No 




"2460813579" 


2 


0000 0100 
0000 0100 


Yes 

No, except for ACC 


246 
081 


No 


No 




"2460813579" 


3 


0000 0100 
0000 1000 


Yes 

No, except for ACC 


246 
081 


No 


No 




"2460813579" 


4 


0000 0100 

0001 0000 


Yes 

No, except for ACC 


246 
081 


No 


No 




"2460813579" 


5 


0000 0100 
0010 0000 


Yes 

No, except for ACC 


246 
081 


No 


No 




"2460813579" 


6 


0000 0100 
0100 0000 


Yes 

No, except for ACC 


246 
081 


No 


No 




"2460813579" 


7 


0000 0100 
1000 0000 


Yes 

No, except for ACC 


246 
081 


No 


No 




"2460813579" 


8 


0000 0101 
0000 0000 


Yes 

No, except for ACC 


246 
081 


No 


No 




"2460813579" 


9 


0000 0110 
0000 0000 


Yes 

No, except for ACC 


246 
081 


No 


No 


Test (d) 


"2460813579" 





0000 0000 
0000 0001 


No 

None, except for 
ACC 


246 
081 


No 


Yes 




"2460813579" 


1 


0000 0000 
0000 0010 


No 

None, except for 
ACC 


246 
081 


No 


Yes 




"2460813579" 


2 


0000 0000 
0000 0100 


No 

None, except for 
ACC 


246 
081 


No 


Yes 




"2460813579" 


3 


0000 0000 


No 


246 


No 


Yes 
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0000 1000 


None, except for 
ACC 


081 






"2460813579" 


4 


0000 0000 

0001 0000 


No 

None, except for 
ACC 


246 
081 


No 


Yes 


"2460813579" 


5 


0000 0000 
0010 0000 


No 

None, except for 
ACC 


246 
081 


No 


Yes 


"2460813579" 


6 


0000 0000 
0100 0000 


No 

None, except for 
ACC 


246 
081 


No 


Yes 


"2460813579" 


7 


0000 0000 
1000 0000 


No 

None, except for 
ACC 


246 
081 


No 


Yes 


"2460813579" 


8 


0000 0001 
0000 0000 


No 

None, except for 
ACC 


246 
081 


No 


Yes 


"2460813579" 


9 


0000 0010 
0000 0000 


No 

None, except for 
ACC 


246 
081 


No 


Yes 
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Test (e) 


"2460813579" 





1111 1011 
1111 1110 


No 

All, except ACC on 
USIM 


246 
081 


Yes 


Yes 




"2460813579" 


1 


1111 1011 
1111 1101 


No 

All, except ACC on 
USIM 


246 
081 


Yes 


Yes 




"2460813579" 


2 


1111 1011 
1111 1011 


No 

All, except ACC on 
USIM 


246 
081 


Yes 


Yes 




"2460813579" 


3 


1111 1011 
1111 0111 


No 

All, except ACC on 
USIM 


246 
081 


Yes 


Yes 




"2460813579" 


4 


1111 1011 
1110 1111 


No 

All, except ACC on 
USIM 


246 
081 


Yes 


Yes 




"2460813579" 


5 


1111 1011 
1101 1111 


No 

All, except ACC on 
USIM 


246 
081 


Yes 


Yes 




"2460813579" 


6 


1111 1011 
1011 1111 


No 

All, except ACC on 
USIM 


246 
081 


Yes 


Yes 




"2406813579" 


7 


1111 1011 
0111 1111 


No 

All, except ACC on 
USIM 


246 
081 


Yes 


Yes 




"2460813579" 


8 


1111 1010 
1111 1111 


No 

All, except ACC on 
USIM 


246 
081 


Yes 


Yes 




"2460813579" 


9 


1111 1001 
1111 1111 


No 

All, except ACC on 
USIM 


246 
081 


Yes 


Yes 


Test (f) 


"24608135x9" 


11 &x 


0000 0111 

1111 1111 


Yes 

All, except ACC 
greater than 1 1 


246 
082 


No 


No 






11 &x 


0000 001 1 

1111 1111 


No 

All, except ACC 
greater than 1 1 


246 
082 


No 


Yes 






11 &x 


0000 0000 
0000 0000 


No 
None 


246 
082 


Yes 


Yes 




"24608135x9" 


12 &x 


0000 0111 

1111 1111 


Yes 

All, except ACC 
greater than 1 1 


244 
001 


No 


No 






12&X 


0000 001 1 

1111 1111 


No 

All, except ACC 
greater than 1 1 


244 
001 


No 


Yes 






12 &x 


0000 0000 
0000 0000 


No 
None 


244 
001 


Yes 


Yes 




"24608135x9" 


13&X 


0000 0111 

1111 1111 


Yes 

All, except ACC 
greater than 1 1 


244 
001 


No 


No 






13&X 


0000 001 1 


No 


244 


No 


Yes 
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1111 1111 


All, except ACC 
greater than 1 1 


001 








13 &x 


0000 0000 
0000 0000 


No 
None 


244 
001 


Yes 


Yes 


"24608135x9" 


14 &x 


0000 0111 
1111 1111 


Yes 

All, except ACC 
greater than 1 1 


244 
001 


No 


No 




14&X 


0000 001 1 
1111 1111 


No 

All, except ACC 
greater than 1 1 


244 
001 


No 


Yes 




14 &x 


0000 0000 
0000 0000 


No 
None 


244 
001 


Yes 


Yes 


"24608135x9" 


15 &x 


0000 0111 

1111 1111 


Yes 

All, except ACC 
greater than 1 1 


246 
082 


No 


No 


II 


15&X 


0000 001 1 

1111 1111 


No 

All, except ACC 
greater than 1 1 


246 
082 


No 


Yes 


II 

Set "x" to an 
arbitrary value in 
the range to 9 


15&X 


0000 0000 
0000 0000 


No 
None 


246 
082 


Yes 


Yes 


Test(g) "2460813579" 


11 &x 


0000 1111 

1111 1111 


Yes 

All normal ACC and 
ACC on USIM 


246 
081 


No 


No 




11 &x 


0000 1011 

1111 1111 


No 

All normal ACC and 
ACC on USIM 


246 
081 


No 


Yes 


"2460813579" 


12 &x 


0001 0111 

1111 1111 


Yes 

All normal ACC and 
ACC on USIM 


246 
082 


No 


No 




12&X 


0001 0011 

1111 1111 


No 

All normal ACC and 
ACC on USIM 


246 
082 


No 


Yes 


"2460813579" 


13&X 


00100111 
1111 1111 


Yes 

All normal ACC and 
ACC on USIM 


246 
082 


No 


No 




13&X 


0010 0011 

1111 1111 


No 

All normal ACC and 
ACC on USIM 


246 
082 


No 


Yes 


"2460813579" 


14&X 


0100 0111 
1111 1111 


Yes 

All normal ACC and 

fill 1 l\Jl 1 1 ICll C(l IVJ 

ACC on USIM 


246 
082 


No 


No 




14&X 


0100 0011 

1111 1111 


No 

All normal ACC and 
ACC on USIM 


246 
082 


No 


Yes 


"2460813579" 


15&X 


1000 0111 

1111 1111 


Yes 

All normal ACC and 
ACC on USIM 


246 
081 


No 


No 
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II 


15&X 


1000 0011 


No 


246 


No 


Yes 


Set "X" to an 
arbitrary value in 
the range to 9 




1111 1111 


All normal ACC and 
ACC on USIM 


081 






Test(h) "2460813579" 


11 &x 


1111 0011 
1111 1111 


No 

All, except "special" 
ACC on USIM 


246 
081 


Yes 


Yes 




11 &x 


1111 0111 
1111 1111 


Yes 

All, except "special" 
ACC on USIM 


246 
081 


Yes 


Yes 


"2460813579" 


12&X 


1110 1011 

1111 1111 


No 

All, except "special" 
ACC on USIM 


246 
082 


Yes 


Yes 




12&X 


1110 1111 

1111 1111 


Yes 

All, except "special" 
ACC on USIM 


246 
082 


Yes 


Yes 


"2460813579" 


13&X 


1101 1011 
1111 1111 


No 

All, except "special" 
ACC on USIM 


246 
082 


Yes 


Yes 




13&X 


1101 1111 
1111 1111 


Yes 

All, except "special" 
ACC on USIM 


246 
082 


Yes 


Yes 


"2460813579" 


14&X 


1011 1011 
1111 1111 


No 

All, except "special" 
ACC on USIM 


246 
082 


Yes 


Yes 


II 


14&X 


1011 1111 
1111 1111 


Yes 

All, except "special" 
ACC on USIM 


246 
082 


Yes 


Yes 


"2460813579" 


15&X 


0111 1011 
1111 1111 


No 

All, except "special" 
ACC on USIM 


246 
081 


Yes 


Yes 




15&X 


0111 1111 


Yes 


246 


Yes 


Yes 


Set "x" to an 
arbitrary value in 
the range to 9 




1111 1111 


All, except "special" 
ACC on USIM 


081 
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Table 5-1 b 



USIM 


Network 


Test Results 


IMSI 


RACH 


Informative: Cell 
Barred for: 


BCCH/ 
LAI 


Normal 
Call 


Emergency 
Call 


Access 
Class 


Octet 3 
Octet 4 


Emergency Call 
Normal Call 


MCC 
MNC 




Test (a) 


No UlCC in 
Terminal 


N/A 


0000 0100 
0000 0000 


Yes 
No 


234 
001 


No 


No 


Test (b) 


No UlCC in 
Terminal 


N/A 


0000 0000 
0000 0000 


No 
No 


234 
001 


No 


Yes 


Test (c) 


"2460813579" 





0000 0100 
0000 0001 


Yes 

No, except for ACC 


246 
081 


No 


No 




"2460813579" 


1 


0000 0100 
0000 0010 


Yes 

No, except for ACC 


246 
081 


No 


No 




"2460813579" 


2 


0000 0100 
0000 0100 


Yes 

No, except for ACC 


246 
081 


No 


No 




"2460813579" 


3 


0000 0100 
0000 1000 


Yes 

No, except for ACC 


246 
081 


No 


No 




"2460813579" 


4 


0000 0100 

0001 0000 


Yes 

No, except for ACC 


246 
081 


No 


No 




"2460813579" 


5 


0000 0100 
0010 0000 


Yes 

No, except for ACC 


246 
081 


No 


No 




"2460813579" 


6 


0000 0100 
0100 0000 


Yes 

No, except for ACC 


246 
081 


No 


No 




"2460813579" 


7 


0000 0100 
1000 0000 


Yes 

No pxcpot for ACC 


246 
081 


No 


No 




"2460813579" 


8 


0000 0101 
0000 0000 

\J\J\J\J \J\J\J\J 


Yes 

No pxrpnt for ACC 


246 
081 


No 


No 




"2460813579" 


9 


0000 0110 
0000 0000 


Yes 

No pxppot for ACC 


246 
081 


No 


No 


Test (d) 


"2460813579" 





0000 0000 
0000 0001 


No 

None, except for ACC 


246 
081 


No 


Yes 




"2460813579" 


1 


0000 0000 
0000 0010 


No 

None, except for ACC 


246 
081 


No 


Yes 




"2460813579" 


2 


0000 0000 
0000 0100 


No 

None, except for ACC 


246 
081 


No 


Yes 




"2460813579" 


3 


0000 0000 
0000 1000 


No 

None, except for ACC 


246 
081 


No 


Yes 




"2460813579" 


4 


0000 0000 

0001 0000 


No 

None, except for ACC 


246 
081 


No 


Yes 




"2460813579" 


5 


0000 0000 
0010 0000 


No 

None, except for ACC 


246 
081 


No 


Yes 
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"2460813579" 


6 


0000 0000 
0100 0000 


No 

None, except for ACC 


246 
081 


No 


Yes 


"2460813579" 


7 


0000 0000 
1000 0000 


No 

None, except for ACC 


246 
081 


No 


Yes 


"2460813579" 


8 


0000 0001 
0000 0000 


No 

None, except for ACC 


246 
081 


No 


Yes 


"2460813579" 


9 


0000 0010 
0000 0000 


No 

None, except for ACC 


246 
081 


No 


Yes 
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Test (e) 


"2460813579" 





1111 1011 
1111 1110 


No 

All, except ACC on 
USIM 


246 
081 


Yes 


Yes 




"2460813579" 


1 


1111 1011 
1111 1101 


No 

All, except ACC on 
USIM 


246 
081 


Yes 


Yes 




"2460813579" 


2 


1111 1011 
1111 1011 


No 

All, except ACC on 
USIM 


246 
081 


Yes 


Yes 




"2460813579" 


3 


1111 1011 
1111 0111 


No 

All, except ACC on 
USIM 


246 
081 


Yes 


Yes 




"2460813579" 


4 


1111 1011 
1110 1111 


No 

All, except ACC on 
USIM 


246 
081 


Yes 


Yes 




"2460813579" 


5 


1111 1011 
1101 1111 


No 

All, except ACC on 
USIM 


246 
081 


Yes 


Yes 




"2460813579" 


6 


1111 1011 
1011 1111 


No 

All, except ACC on 
USIM 


246 
081 


Yes 


Yes 




"2406813579" 


7 


1111 1011 
0111 1111 


No 

All, except ACC on 
USIM 


246 
081 


Yes 


Yes 




"2460813579" 


8 


1111 1010 
1111 1111 


No 

All, except ACC on 
USIM 


246 
081 


Yes 


Yes 




"2460813579" 


9 


1111 1001 
1111 1111 


No 

All, except ACC on 
USIM 


246 
081 


Yes 


Yes 


Test (f) 


"24608135x9" 


11 &x 


0000 0111 

1111 1111 


Yes 

All, except ACC 
greater than 1 1 


246 
082 


No 


No 






11 &x 


0000 001 1 

1111 1111 


No 

All, except ACC 
greater than 1 1 


246 
082 


No 


Yes 






11 &x 


0000 0000 
0000 0000 


No 
None 


246 
082 


Yes 


Yes 




"24608135x9" 


12 &x 


0000 0111 

1111 1111 


Yes 

All, except ACC 
greater than 1 1 


244 
001 


No 


No 






12&X 


0000 001 1 

1111 1111 


No 

All, except ACC 
greater than 1 1 


244 
001 


No 


Yes 






12 &x 


0000 0000 
0000 0000 


No 
None 


244 
001 


Yes 


Yes 




"24608135x9" 


13&X 


0000 0111 

1111 1111 


Yes 

All, except ACC 
greater than 1 1 


244 
001 


No 


No 






13&X 


0000 001 1 


No 


244 


No 


Yes 
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1111 1111 


All, except ACC 
greater than 1 1 


001 








13 &x 


0000 0000 
0000 0000 


No 
None 


244 
001 


Yes 


Yes 


"24608135x9" 


14 &x 


0000 0111 
1111 1111 


Yes 

All, except ACC 
greater than 1 1 


244 
001 


No 


No 




14&X 


0000 001 1 
1111 1111 


No 

All, except ACC 
greater than 1 1 


244 
001 


No 


Yes 




14 &x 


0000 0000 
0000 0000 


No 
None 


244 
001 


Yes 


Yes 


"24608135x9" 


15 &x 


0000 0111 

1111 1111 


Yes 

All, except ACC 
greater than 1 1 


246 
082 


No 


No 


II 


15&X 


0000 001 1 

1111 1111 


No 

All, except ACC 
greater than 1 1 


246 
082 


No 


Yes 


II 

Set "x" to an 
arbitrary value in 
the range to 9 


15&X 


0000 0000 
0000 0000 


No 
None 


246 
082 


Yes 


Yes 


Test(g) "2460813579" 


11 &x 


0000 1111 

1111 1111 


Yes 

All normal ACC and 
ACC on USIM 


246 
081 


No 


No 




11 &x 


0000 1011 

1111 1111 


No 

All normal ACC and 
ACC on USIM 


246 
081 


No 


Yes 


"2460813579" 


12 &x 


0001 0111 

1111 1111 


Yes 

All normal ACC and 
ACC on USIM 


246 
082 


No 


No 




12&X 


0001 0011 

1111 1111 


No 

All normal ACC and 
ACC on USIM 


246 
082 


No 


Yes 


"2460813579" 


13&X 


00100111 
1111 1111 


Yes 

All normal ACC and 
ACC on USIM 


246 
082 


No 


No 




13&X 


0010 0011 

1111 1111 


No 

All normal ACC and 
ACC on USIM 


246 
082 


No 


Yes 


"2460813579" 


14&X 


0100 0111 
1111 1111 


Yes 

All normal ACC and 

fill 1 1 1 icii fivyvy Cll IVJ 

ACC on USIM 


246 
082 


No 


No 




14&X 


0100 0011 

1111 1111 


No 

All normal ACC and 
ACC on USIM 


246 
082 


No 


Yes 


"2460813579" 


15&X 


1000 0111 

1111 1111 


Yes 

All normal ACC and 
ACC on USIM 


246 
081 


No 


No 
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II 


15&X 


1000 0011 


No 


246 


No 


Yes 


Set "X" to an 
arbitrary value in 
the range to 9 




1111 1111 


All normal ACC and 
ACC on USIM 


081 






Test(h) "2460813579" 


11 &x 


1111 0011 
1111 1111 


No 

All, except "special" 
ACC on USIM 


246 
081 


Yes 


Yes 




11 &x 


1111 0111 
1111 1111 


Yes 

All, except "special" 
ACC on USIM 


246 
081 


Yes 


Yes 


"2460813579" 


12&X 


1110 1011 

1111 1111 


No 

All, except "special" 
ACC on USIM 


246 
082 


Yes 


Yes 




12&X 


1110 1111 

1111 1111 


Yes 

All, except "special" 
ACC on USIM 


246 
082 


Yes 


Yes 


"2460813579" 


13&X 


1101 1011 
1111 1111 


No 

All, except "special" 
ACC on USIM 


246 
082 


Yes 


Yes 




13&X 


1101 1111 
1111 1111 


Yes 

All, except "special" 
ACC on USIM 


246 
082 


Yes 


Yes 


"2460813579" 


14&X 


1011 1011 
1111 1111 


No 

All, except "special" 
ACC on USIM 


246 
082 


Yes 


Yes 


II 


14&X 


1011 1111 
1111 1111 


Yes 

All, except "special" 
ACC on USIM 


246 
082 


Yes 


Yes 


"2460813579" 


15&X 


0111 1011 
1111 1111 


No 

All, except "special" 
ACC on USIM 


246 
081 


Yes 


Yes 




15&X 


0111 1111 


Yes 


246 


Yes 


Yes 


Set "x" to an 
arbitrary value in 
the range to 9 




1111 1111 


All, except "special" 
ACC on USIM 


081 
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Abnormal Case, No Test 



No Calls, All Calls, 

Test (g) Test (h) 

applies applies 



NOTE: UE adopts Access Class 0-9, based on IMSI, see TS 22.01 1 [6]. 

Access Class in USIM, See TS 31 .102 [4], EF ACC, "6F 78". 
Ecs: Emergency Calls. 
EC Bit: In caseof GERAN: 

Bit 3 of Octet 3 of RACH Control Parameters, See TS 44.018 Section 10.5.2.29. 

In case of UTRAN 

Access Class 10 defined in TS 22.01 1 clause 4.4. 
AC Bit: See Access Class Barred List defined in TS 25.331 clause 10.3.2.1 . 
HPLMN: Country means that the MCC of the VPLMN is the same as the MCC of the HPLMN. 

Figure 5-1 : Access control information 
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5.2.2 Access Control information handling for E-UTRAN/EPC 

5.2.2.1 Definition and applicability 

Access Control allows restriction of EPS bearer context activation access attempts. All User Equipments are assigned to 
one out of ten randomly allocated classes, and optionally (for priority uses) also to one or more special categories. 

An Access Class of the special categories is only valid in the HPLMN or HPLMN country. Otherwise, the randomly 
allocated class is used. 

The classes are programmed on the USIM. The network controls which classes at any time may be barred. 
Emergency call handling is FES. 

5.2.2.2 Conformance requirement 

1. The Terminal shall read the access control value as part of the USIM-Terminal initialisation procedure, and 
subsequently adopt this value. 

Reference: 

- TS 31.102 [4], subclause 5.1.1. 

2. If the UE is a member of at least one access class which corresponds to the permitted classes as signalled over 
the air interface, and the access class is applicable in the serving network,access attempts are allowed . 
Otherwise access attempts are not allowed. 

All options are shown in figure 5-2 and are referenced to the tests. 

Reference: 

- TS 22.01 1 [6], subclauses 4.3 and 4.4, 

- TS 24.301 [26], subclause 5.5.1.2.6, 

5.2.2.3 Test purpose 

1) To verify that the Terminal reads the access control value as part of the USIM-Terminal initialisation procedure, 
and subsequently adopts this value. 

2) To verify that the UE controls its network access in accordance with its access control class and the conditions 
imposed by the serving network. 

The tests verify Terminal performance for the following: 

Tests (a) to (b) UE with access class to 9. 

Test (c) UE with access class 1 1 and 15 not in HPLMN, and 

UE with access class 12,13 and 14 not in HPLMN country. 

Test (d) and (e) UE with access class 1 1 and 15 in HPLMN, and 

UE with access class 12,13 and 14 in HPLMN country. 

Each of the above are tested against all relevant combinations of access control bits signalled by the network, as shown 
in table 5-2. 

5.2.2.4 Method of test 
5.2.2.4.1 Initial conditions 

The E-USS transmits on the BCCH, with the following network parameters: 

- TAI (MCC/MNC/TAC): MCC, MNC: see table 5-2, TAC="0001 ". 
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Access control: 



see table 5-2. 



The default UICC is installed in the Terminal containing IMSI and access control values as given in table 5-x and the 
UE is powered on. 

NOTE: Depending on the initial value of the EFEPSLOcb the UE may perform a location update. This shall be 
accepted by the E-USS. 

5.2.2.4.2 Coding details 

EFiMsi: Data Field "6F 07" 
Logically: IMSI: 



Coding: B1 
Hex 06 



B2 
21 



B3 
64 



2460813579" 

84 
80 



B5 
31 



B6 
75 



87 
F9 



B8 
FF 



B9 
FF 



Logically: 

Coding: 81 
Hex 06 



IMSI: 

B2 
21 



B3 
64 



"24608135x9" 

84 
80 



B5 
31 



B6 
x5 



87 
F9 



B8 
FF 



B9 
FF 



Access Control class EFacc- Data field "6F 78" 
Reference: 

• See TS 31.102 [4]. 
NETWORK (E-USS) 

ac-Barringlnfo in SysteniInformationBlockType2 should be set as in table 5-2: 
Reference 

• TS 36.331 clause 6.3.1 

5.2.2.4.3 Procedure 

a) The terminal is switched on and performs registration if access is allowed for signalling according to table 5-2. 

b) Using the MMI or EMMI a normal EPS bearer context setup is attempted if required by the test. 

c) The test is repeated for each set of values in table 5-2. 

5.2.2.5 Acceptance criteria 

After step a) the UE shall access the network, or shall make no access attempt, in accordance with table 5-2. 
In case in tables 5-2 the cell is indicated as 

barred = yes, in these sub-sequences, the UE shall not establish a connection 

barred = no, the UE shall establish a connection. 



NOTE 1: For conformance testing, to limit testing, in tests (a), (b) and (c) it is only necessary that one of the access 
classes is tested. This access class may be chosen randomly. 
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Table 5-2 



USIM 


Network 




IMSI 


Access 
class: 


SIBType2: 
ac-Barringlnfo 


Cell barred 
for ATTACH 
and Default 
EPS bearer 

context 
aciivaiion. 


MCC 
MNC 

for 
BCCH/ 

LAI 


Cell barred for 
second (non- 
default) EPS 

bearer context 
setup: 


Test (a) 


"2460813579" 





SIBType2_A01 


No 


246 
081 


Yes 




"2460813579" 


1 


SIBType2_A01 


No 


246 
081 


Yes 




"2460813579" 


2 


SIBType2_A01 


No 


246 
081 


Yes 




"2460813579" 


3 


SIBType2_A01 


No 


246 
081 


Yes 




"2460813579" 


4 


SIBType2_A01 


No 


246 
081 


Yes 




"2460813579" 


5 


SIBType2_A01 


No 


246 
081 


Yes 




"2460813579" 


6 


SIBType2_A01 


No 


246 
081 


Yes 




"2460813579" 


7 


SIBType2_A01 


No 


246 
081 


Yes 




"2460813579" 


8 


SIBType2_A01 


No 


246 
081 


Yes 




"2460813579" 


9 


SIBType2_A01 


No 


246 
081 


Yes 


Test (b) 


"2460813579" 





SIBType2_B01 


No 


246 
081 


No 




"2460813579" 


1 


SIBType2_B01 


No 


246 
081 


No 




"2460813579" 


2 


SIBType2_B01 


No 


246 
081 


No 




"2460813579" 


3 


SIBType2_B01 


No 


246 
081 


No 




"2460813579" 


4 


SIBType2_B01 


No 


246 
081 


No 




"2460813579" 


5 


SIBType2_B01 


No 


246 
081 


No 




"2460813579" 


6 


SIBType2_B01 


No 


246 
081 


No 




"2460813579" 


7 


SIBType2_B01 


No 


246 
081 


No 
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"2460813579" 


8 


SIBType2_B01 


No 


246 
081 


No 


"2460813579" 


9 


SIBType2_B01 


No 


246 
081 


No 
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Test (c) 


"24608135x9" 


11 &x 


SIBType2_A01 


No 


246 
082 


No 






11 &x 


SIBType2_C11_01 


No 


246 
082 


Yes 






11 &x 


SIBType2_C11_02 


Yes 


246 
082 


N/A 

(no registration 
possible as initial 
condition) 




"24608135x9" 


12&X 


SIBType2_A01 


No 


244 
001 


No 




II 


12&X 


SIBType2_C12_01 


No 


244 
001 


Yes 




II 


12&X 


SIBType2_C12_02 


Yes 


244 
001 


N/A 

(no registration 
possible as initial 
condition) 




"24608135x9" 


13&X 


SIBType2_A01 


No 


244 
001 


No 




II 


13&X 


SIBType2_C13_01 


No 


244 
001 


Yes 




II 


13&X 


SIBType2_C13_02 


Yes 


244 
001 


N/A 

(no registration 
possible as initial 
condition) 




"24608135x9" 


14&X 


SIBType2_A01 


No 


244 
001 


No 




II 


14&X 


SIBType2_C14_01 


No 


244 
001 


Yes 




II 


14&X 


SIBType2_C14_02 


Yes 


244 
001 


N/A 

(no registration 
possible as initial 
condition) 




"24608135x9" 


15&X 


SIBType2_A01 


No 


246 
082 


No 




II 


15&X 


SIBType2_C15_01 


No 


246 
082 


Yes 




Set "X" to an 
arbitrary value in 
the range to 9 


15 &x 


SI BType2_C1 5_02 


Yes 


246 
082 


N/A 

(no registration 
possible as initial 
condition) 


Test (d) 


"2460813579" 


11 &x 


SIBType2_C11_01 


No 


246 
081 


Yes 




II 


11 &x 


SIBType2_C11_02 


Yes 


246 
081 


N/A 
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"2460813579" 


12 &x 


SIBType2_C12_01 


No 


246 
082 


Yes 


II 


12&X 


SIBType2_C12_02 


Yes 


246 
082 


N/A 


"2460813579" 


13&X 


SIBType2_C13_01 


No 


246 
082 


Yes 


II 


1 A Y 
1 O Ol A 




Ypq 

T CO 


082 


M/A 


"2460813579" 


14&X 


SIBType2_C14_01 


No 


246 
082 


Yes 




1 H- Ol A 


Ol D 1 ypc^ w 1 1 


T CO 


082 


M/A 


"2460813579" 


15&X 


SIBType2_C15_01 


No 


246 
081 


Yes 


Set "x" to an 
arbitrary value in 
the range to 9 


15 &x 


SIBType2_C15_02 


Yes 


246 
081 


N/A 


Test(e) "2460813579" 


11 &x 


SIBType2_C11_01 


No 


246 
081 


No 




11 &x 


SIBType2_C11_01 


No 


246 
081 


No 


"2460813579" 


12 &x 


SIBType2_C12_01 


No 


246 
082 


No 




12 &x 


SIBType2_C12_02 


No 


246 
082 


No 


"2460813579" 


13&X 


SIBType2_C13_01 


No 


246 
082 


No 




13&X 


SIBType2_C13_02 


No 


246 
082 


No 


"2460813579" 


14&X 


SIBType2_C14_01 


No 


246 
082 


No 




14&X 


SIBType2_C14_02 


No 


246 
082 


No 


"2460813579" 


15&X 


SIBType2_C15_01 


No 


246 
081 


No 


Set "x" to an 
arbitrary value in 
the range to 9 


15&X 


SIBType2_C15_02 


No 


246 
081 


No 
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Specific message contents for Table 5-2 



SystemlnformationBlockType2 coni'\gura\\on SIBType2_A01 



Derivation Path: 36.508, Table 4.4.3.3-1 


iriTorrnaxiori dsmcni 


ValU6/ rcrnaiK 


v^ornrncni 


v^onuiiion 


System lnformationBlockType2 ::= SEQUENCE { 








ac-Barringlnfo SEQUENCE { 








ac-BarringForEmergency 


FALSE 






ac-BarringForMO-Signalling 


Not present 






ac-BarringForMO-Data SEQUENCE { 








ac-BarringFactor 


pOO 






ac-BarringTime 


s512 






ac-BarringForSpecialAC 


'OOOOO'B 






} 








} 








} 









SystemlnformationBlockType2 conilguraWon SIBType2_B01 



Derivation Path: 36.508, Table 4.4.3.3-1 


Information Element 


Value/remark 


Comment 


Condition 


SystemlnformationBlockType2 ::= SEQUENCE { 








ac-Barringlnfo SEQUENCE { 








ac-BarringForEmergency 


FALSE 






ac-BarringForMO-Signalling 


Not present 






ac-BarringForMO-Data 


Not present 






} 








} 









SystemlnformationBlockType2 configuration SIBType2_C1 1_01 



Derivation Path: 36.508, Table 4.4.3.3-1 


Information Element 


Value/remark 


Comment 


Condition 


SystemlnformationBlockType2 ::= SEQUENCE { 








ac-Barringlnfo SEQUENCE { 








ac-BarringForEmergency 


FALSE 






ac-BarringForMO-Signalling 


Not present 






ac-BarringForMO-Data SEQUENCE { 








ac-BarringFactor 


pOO 






ac-BarringTime 


s512 






ac-BarringForSpecialAC 


'10000'B 






} 








} 








} 









SystemlnformationBlockType2 configuration SIBType2_C1 1_02 



Derivation Path: 36.508, Table 4.4.3.3-1 


Information Element 


Value/remark 


Comment 


Condition 


SystemlnformationBlockType2 ::= SEQUENCE { 








ac-Barringlnfo SEQUENCE { 








ac-BarringForEmergency 


FALSE 






ac-BarringForMO-Signalling SEQUENCE { 








ac-BarringFactor 


pOO 






ac-BarringTime 


s512 






ac-BarringForSpecialAC 


'10000'B 






} 








ac-BarringForMO-Data 


Not present 






} 








} 
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SystemlnformationBlockType2 configuration SIBType2_C1 2_01 



Derivation Patli: 36.508, Table 4.4.3.3-1 


II 1 1 Vil 1 1 ICIIIUI 1 dC7lllt7lll 


V dlUt?/ 1 t7l 1 ICII IV 


y^yji 1 II 1 it7i 1 1 


\^\Jl lUlllUI 1 


OyoLUM III IIUI M IClLIUl lOIUUrx 1 y|Jc;^ .. — OCV^LJdNOC \ 








ac-Barrinalnfo SEQUENCE ( 








ac-BarringForEmergency 


PALSE 






ac-BarringForMO-Signalling 


Not present 






ac-BarringPorMO-Data SEQUENCE { 








ac-BarringPactor 


pOO 






ac-BarhngTlme 


s512 






ac-BarringPorSpecialAC 


'01000'B 






} 








} 








} 









SystemlnformationBlockType2 configuration SIBType2_C1 2_02 



Derivation Path: 36.508, Table 4.4.3.3-1 


Information Element 


Value/remark 


Comment 


Condition 


SystemlnformationBlockType2 ::= SEQUENCE { 








ac-Barringlnfo SEQUENCE { 








ac-BarringPorEmergency 


PALSE 






ac-BarringPorlVIO-Signalling SEQUENCE { 








ac-BarringPactor 


pOO 






ac-BarringTime 


s512 






ac-BarringPorSpecialAC 


'01000'B 






} 








ac-BarringPorlVIO-Data 


Not present 






} 








} 









SystemlnformationBlockType2 configuration SIBType2_C1 3_01 



Derivation Path: 36.508, Table 4.4.3.3-1 


Information Element 


Value/remark 


Comment 


Condition 


SystemlnformationBlockType2 ::= SEQUENCE { 








ac-Barringlnfo SEQUENCE { 








ac-BarringPorEmergency 


PALSE 






ac-BarringPorMO-Signalling 


Not present 






ac-BarringPorMO-Data SEQUENCE { 








ac-BarringPactor 


pOO 






ac-BarringTime 


s512 






ac-BarringPorSpecialAC 


'00100'B 






} 








} 
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SystemlnformationBlockType2 configuration SIBType2_C1 3_02 



Derivation Patli: 36.508, Table 4.4.3.3-1 


IIIIUI IIICIIIUII Cldlldll 


X/dli lo/Komcii'lf 


Vi/Ullllllt;lll 


v/UIIUIllUII 


OyoLUM III IIUl M IClLIUl lOIUUrx 1 y|Jc;^ .. — OCV^LJdNOC \ 








ac-Barrinalnfo SEQUENCE ( 








ac-BarringForEmergency 


FALSE 






ac-BarringForMO-Signalling SEQUENCE { 








ac-BarringPactor 


pOO 






ac-BarringTime 


s512 






ac-BarringForSpecialAC 


'00100'B 






} 








ac-BarringForlVIQ-Data 


Not present 






} 








} 









SystemlnformationBlockType2 configuration SIBType2_C1 4_01 



Derivation Patli: 36.508, Table 4.4.3.3-1 


Information Element 


Value/remark 


Comment 


Condition 


SystemlnformationBlockType2 ::= SEQUENCE { 








ac-Barringlnfo SEQUENCE { 








ac-BarringForEmergency 


FALSE 






ac-BarringForMO-Signalling 


Not present 






ac-BarringForMO-Data SEQUENCE { 








ac-BarringFactor 


pOO 






ac-BarringTime 


s512 






ac-BarringPorSpecialAC 


'0001 0'B 






} 








} 








} 









SystemlnformationBlockType2 configuration SIBType2_C1 4_02 



Derivation Path: 36.508, Table 4.4.3.3-1 


Information Element 


Value/remark 


Comment 


Condition 


SystemlnformationBlockType2 ::= SEQUENCE { 








ac-Barringlnfo SEQUENCE { 








ac-BarringForEmergency 


FALSE 






ac-BarringForMO-Signalling SEQUENCE { 








ac-BarringFactor 


pOO 






ac-BarringTime 


s512 






ac-BarringPorSpecialAC 


'0001 0'B 






} 








ac-BarringPorMO-Data 


Not present 






} 








} 









SystemlnformationBlockType2 configuration SIBType2_C1 5_01 



Derivation Path: 36.508, Table 4.4.3.3-1 


Information Element 


Value/remark 


Comment 


Condition 


SystemlnformationBlockType2 ::= SEQUENCE { 








ac-Barringlnfo SEQUENCE { 








ac-BarringPorEmergency 


FALSE 






ac-BarringForMO-Signalling 


Not present 






ac-BarringPorMO-Data SEQUENCE { 








ac-BarringFactor 


pOO 






ac-BarringTime 


s512 






ac-BarringPorSpecialAC 


'00001 'B 






} 








} 








} 
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SystemlnformationBlockType2 configuration SIBType2_C1 5_02 



Derivation Patli: 36.508, Table 4.4.3.3-1 


IIIIUI lllclllUII dt^llldll 


X/dli lo/Komcii'lf 


Vi/Ullllllt;lll 


v/UIIUIllUII 


OyoLUM III IIUl M IClLIUl lOIUUrx 1 y|Jc;^ .. — OCV^LJdNOC \ 








ac-Barrinalnfo SEQUENCE ( 








ac-BarringForEmergency 


FALSE 






ac-BarringForMO-Signalling SEQUENCE { 








ac-BarringPactor 


pOO 






ac-BarringTime 


s512 






ac-BarringForSpecialAC 


'OOOOVB 






} 








ac-BarringForlVIQ-Data 


Not present 






} 








} 
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ECs only, 
Test (b) applies 




EPS bearer context 
activation allowed, 
ECs NOT allowed 
Abnormal Case, No 
Test 



EPS bearer 
context 

activation + ECs 
allowed. 
Test (e) applies 



No EPS bearer context 
activation, no ECs, 
Test (g) applies 



EPS bearer context 
activation + ECs 

allowed, 

Test (h) applies 



EPS bearer context 

activation + ECs 

allowed. 

Test (h) applies 



Editor's note: the flow chart is currently for information only and has to be updated to be in line with 36.331, this is 
TBD. 

NOTE: UE adopts Access Class 0-9, based on IMSI, see TS 22.01 1 [6]. 

Access Class in USIM, See TS 31 .102 [4], EF ACC, "6F 78". 
ECs: Emergency Calls. 
EC Bit: see description in 36.331 , clause 6.3.1 

Access Class 10 defined in TS 22.01 1 clause 4.4. 
AC Bit: see description in 36.331 , clause 6.3.1 . 

HPLMN: Country means that the MCC of the VPLMN is the same as the MCC of the HPLMN. 



Figure 5-2: Access control information 
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6 Security related Tests 

6.1 PIN handling 
6.1.1 Entry of PIN 

6.1 .1 .1 Definition and applicability 

The PIN is a number used to authenticate the user to the UICC for security. Entry of the correct PIN allows PIN- 
protected data to be accessed over the UICC-Terminal interface. 

6.1 .1 .2 Conformance requirement 

Following insertion of the UICC and switching on the UE, the Terminal shall check the state of the PIN. If the PIN is 
enabled, the Terminal asks the user for PIN verification. 

The VERIFY PIN function verifies the PIN presented by the Terminal to the UICC. 
Reference: 

- ETSI TS 102 221 [5], subclauses 9 and 11.1.9; 

- TS 31.102 [4], clause 6; 

- TS 22.030 [12], subclause 6.6.1. 

6.1.1.3 Test purpose 

1) To verify that the PIN verification procedure is performed by the Terminal correctly. 

2) To verify that the basic public MMI string is supported. 

6.1.1.4 Method of test 

6.1.1.4.1 Initial conditions 

The Terminal is connected to a UICC or UICC simulator with the PIN enabled, and powered off. 
The default UICC is used. 

6.1.1.4.2 Procedure 

a) The Terminal is powered on. 

b) When the UE is in the "PIN check" mode, the sequence "2468#" shall be entered. 

6.1.1.5 Acceptance criteria 

1) After step b) the Terminal shall send a VERIFY PIN command to the UICC, with parameter P2 = "01". 

2) After step b) the UE shall give an indication "OK", following a successful execution of the conmiand. 
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6.1.2 Change of PIN 



6.1.2.1 



Definition and applicability 



The PIN may be changed by the user, by entering the old and new PIN. The length of the PIN is between 4 and 8 digits. 



The Terminal shall support the change of PIN procedure as defined in ETSI TS 102 221 [5], subclause 11.1.10. 
Reference: 

- ETSI TS 102 221 [5], subclauses 9 and 11.1.10; 

- TS 31.102 [4], clause 6; 

- TS 22.030 [12], subclause 6.6.2. 

6.1.2.3 Test purpose 

1) To verify that the PIN substitution procedure is performed correctly by the Terminal. 

2) To verify that the basic public MMI string is supported. 

6.1.2.4 Method of test 

6.1 .2.4.1 Initial conditions 

The Terminal is connected to a UICC or UICC simulator with the PIN enabled. 
The default UICC is used. 

The Terminal is powered-on, with the correct PIN entered. 

6.1.2.4.2 Procedure 

a) Enter "**04*2468*01234567*01234567#" or initiate an equivalent MMI dependent procedure to change the 
PIN from '2468' to '01234567'. 

b) The UE is switched off and on. 

c) When the UE is in the "PIN check" mode, the sequence "2468#" shall be entered. 

d) The UE is switched off and on. 

e) When the UE is in the "PIN-check", mode the sequence "01234567#" shall be entered. 

6.1 .2.5 Acceptance criteria 

1) After step a), the Terminal shall send a CHANGE PIN conmiand to the UICC, with the parameter P2 set to "01". 

2) Following the successful execution of the command, the UE shall give an indication that the new PIN is 
accepted. 

3) After step c), the UE shall give an indication that the entered PIN is not accepted. 

4) After step e), the UE shall give an indication "OK". 



6.1.2.2 



Confornnance requirement 
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6.1.3 



Unblock PIN 



6.1.3.1 



Definition and applicability 



After three consecutive wrong entries of the PIN, the PIN shall become blocked. The Unblock PIN command is used to 
unblock the PIN. This function may be performed whether or not the PIN is blocked. 



The Terminal shall support the Unblock PIN command, as defined in ETSI TS 102 221 [5], subclause 11.1.13. 
Reference: 

- ETSITS 102 221 [5], subclause 11.1.13; 

- TS 31.102 [4], clause 6; 

- TS 22.030 [12], subclause 6.6.3. 

6.1.3.3 Test purpose 

1) To verify that the PIN unblocking procedure is performed correctly. 

2) To verify that the basic public MMI string is supported. 

6.1.3.4 Method of test 

6.1 .3.4.1 Initial conditions 

The Terminal is connected to the UICC simulator. 
The default UICC is used. 

6.1.3.4.2 Procedure 

Sequence A: 

a) The Terminal is powered on and the correct PIN is entered. 

b) Enter "**05*13243546*1234*1234#" 

c) The Terminal is powered off and on. 

d) Enter the new PIN: "1234#". 

e) The Terminal is powered off and on. 

f) Enter a wrong PIN three times. 

g) Enter "**05*13243546*2468*2468#". 

h) The Terminal is powered off and on. 

i) Enter the new PIN: "2468#". 
Sequence B: 

a) The Terminal is powered on. 

b) Enter a wrong PIN three times. 

c) The user shall initiate a MMI dependent procedure to unblock the PIN with unblock code '13243546' and a new 



6.1.3.2 



Conformance requirement 



PIN '2468'. 
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d) The Terminal is powered off and on. 

e) Enter the new PIN: "2468#". 

6. 1 .3.5 Acceptance criteria 

Sequence A: 

1) After step b), the Terminal shall send an UNBLOCK PIN command to the UICC, with parameter P2 = "01". 

2) After step d), the Terminal shall indicate that the PIN has been accepted. 

3) After step f), the Terminal shall indicate that the PIN has been blocked. 

4) After step g), the Terminal shall send an UNBLOCK PIN command to the UICC, with parameter P2 = "01". 

5) After step i), the Terminal shall indicate that the PIN has been accepted. 
Sequence B: 

1) After step b), the Terminal shall indicate that the PIN has been blocked. 

2) After step c), the Terminal shall send an UNBLOCK PIN command to the UICC, with parameter P2 = "01". 

3) After step e), the Terminal shall indicate that the PIN has been accepted. 

6.1.4 Entry of PIN2 

6.1 .4.1 Definition and applicability 

The PIN2 is a number used to authenticate the user to the UICC for security. Entry of the correct PIN2 allows 
PIN2-protected data to be accessed over the UICC-Terminal interface. 

6.1 .4.2 Conformance requirement 

Before allowing the access to PIN2 protected data, the Terminal shall ask the user for PIN2 verification. Only after 
presenting the PIN2, the user shall get access to these data. 

The VERIFY PIN function verifies the PIN2 presented by the Terminal to the UICC. 
Reference: 

- ETSI TS 102 221 [5], subclauses 9 and 11.1.9; 

- TS 31.102 [4], clause 6; 

- TS 22.030 [12], subclause 6.6.1. 

6.1.4.3 Test purpose 

1) To verify that the PIN2 verification procedure is performed by the Terminal correctly. 

2) To verify that the basic public MMI string is supported. 

6.1.4.4 Method of test 
6.1 .4.4.1 Initial conditions 

The Terminal is connected to a UICC or UICC simulator with the PIN enabled, and powered off. 
The default UICC is used. 
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NOTE: To perform the UPDATE FDN data (as described in the procedure below), the default FDN UICC may be 
used. 

6.1.4.4.2 Procedure 

a) The Terminal is powered on and the correct PIN is entered. 

b) The access to a PIN2 protected data field shall be performed (e.g. UPDATE FDN) 

c) When the UE is in the "PIN2 check" mode, the sequence "3579#" shall be entered. 

6. 1 .4.5 Acceptance criteria 

1) After step c) the Terminal shall send a VERIFY PIN command to the UICC, with parameter P2 = "81". 

2) After step c) the UE shall give an indication "OK", following a successful execution of the command. 

6.1.5 Change of PIN2 

6.1 .5.1 Definition and applicability 

The PIN2 may be changed by the user, by entering the old and new PIN2. The length of the PIN2 is between 4 and 8 
digits. 

6.1 .5.2 Conformance requirement 

The Terminal shall support the change of PIN2 procedure as defined in ETSI TS 102 221 [5], subclause 11.1.10. 
Reference: 

- ETSI TS 102 221 [5], subclauses 9 and 11.1.10; 

- TS 31.102 [4], clause 6; 

- TS 22.030 [12], subclause 6.6.2. 

6.1.5.3 Test purpose 

1) To verify that the PIN2 substitution procedure is performed correctly by the Terminal. 

2) To verify that the basic public MMI string is supported. 

6.1.5.4 Method of test 

6.1 .5.4.1 Initial conditions 

The Terminal is connected to a UICC or UICC simulator with the PIN2 enabled. 
The default UICC is used. 

NOTE: To perform the UPDATE FDN data (as described in the procedure below), the default FDN UICC may be 
used. 

The Terminal is powered-on, with the correct PIN entered. 

6.1.5.4.2 Procedure 

a) Enter "**042*3579*12345678*12345678#" or initiate an equivalent MMI dependent procedure to change PIN2 
from '3579' to '12345678'. 

b) The UE is switched off and on and the correct PIN is entered. 
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c) The access to a PIN2 protected data field shall be performed (e.g. UPDATE FDN). 

d) When the UE is in the "PIN2 check" mode, the sequence "3579#" shall be entered. 

e) The UE is switched off and on and the correct PIN is entered. 

f) The access to a PIN2 protected data field shall be performed (e.g. UPDATE FDN). 

g) When the UE is in the "PIN2 check", mode the sequence "12345678#" shall be entered. 

6.1.5.5 Acceptance criteria 

1) After step a), the Terminal shall send a CHANGE PIN2 conmiand to the UICC, with the parameter P2 set to 
"81". 

2) Following the successful execution of the conmiand, the UE shall give an indication that the new PIN2 is 
accepted. 

3) After step d), the UE shall give an indication that the entered PIN2 is not accepted. 

4) After step g), the UE shall give an indication "OK". 

6.1.6 Unblock PIN2 

6.1 .6.1 Definition and applicability 

After three consecutive wrong entries of the PIN2, the PIN2 shall become blocked. The Unblock PIN2 command is 
used to unblock the PIN2. This function may be performed whether or not the PIN2 is blocked. 

6.1 .6.2 Conformance requirement 

The Terminal shall support the Unblock PIN2 conmiand, as defined in ETSI TS 102 221 [5], subclause 11.1.13. 
Reference: 

- ETSI TS 102 221 [5], subclauses 9 and 11.1.13; 

- TS 31.102 [4], clause 6; 

- TS 22.030 [12], subclause 6.6.3. 

6.1.6.3 Test purpose 

1) To verify that the PIN2 unblocking procedure is performed correctly. 

2) To verify that the basic public MMI string is supported. 

6.1.6.4 Method of test 

6.1 .6.4.1 Initial conditions 

The Terminal is connected to the UICC simulator. 
The default UICC is used. 

NOTE: To perform the UPDATE FDN data (as described in the procedure below), the default FDN UICC may be 
used. 

6.1.6.4.2 Procedure 

Sequence A: 
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a) The Terminal is powered on and the correct PIN is entered. 

b) Enter "**052*08978675*1234*1234#" 

c) The Terminal is powered off and on and the correct PIN is entered. 

d) The access to a PIN2 protected data field shall be performed (e.g. UPDATE FDN). 

e) Enter the new PIN2: "1234#". 

f) The Terminal is powered off and on and the correct PIN is entered. 

g) The access to a PIN2 protected data field shall be performed (e.g. UPDATE FDN). 

h) Enter a wrong PIN2 three times. 

i) Enter "**052*08978675*3579*3579#". 

j) The Terminal is powered off and on and the correct PIN is entered, 

k) The access to a PIN2 protected data field shall be performed (e.g. UPDATE FDN). 

1) Enter the new PIN2: "3579#". 
Sequence B: 

a) The Terminal is powered on. 

b) Enter a wrong PIN2 three times. 

c) The user shall initiate a MMI dependent procedure to unblock the PIN2 with unblock code '08978675' and a new 
PIN '3579'. 

d) The Terminal is powered off and on and the correct PIN is entered. 

e) The access to a PIN2 protected data field shall be performed (e.g. UPDATE FDN). 

f) Enter the new PIN2: "3579#". 

6.1.6.5 Acceptance criterias 

Sequence A: 

1) After step b), the Terminal shall send an UNBLOCK PIN conmiand to the UICC, with parameter P2 = "81". 

2) After step e), the Terminal shall indicate that the PIN2 has been accepted. 

3) After step h), the Terminal shall indicate that the PIN2 has been blocked. 

4) After step i), the Terminal shall send an UNBLOCK PIN command to the UICC, with parameter P2 = "81". 

5) After step 1), the Terminal shall indicate that the PIN2 has been accepted. 
Sequence B: 

1) After step b), the Terminal shall indicate that the PIN2 has been blocked. 

2) After step c), the Terminal shall send an UNBLOCK PIN command to the UICC, with parameter P2 = "81". 

3) After step f), the Terminal shall indicate that the PIN2 has been accepted. 
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6.1 .7 Replacement of PIN 

6.1 .7.1 Definition and applicability 

The Universal PIN may be used to replace a PIN used to authenticate the user to the UICC for security. In this case 
entry of the correct Universal PIN allows PIN-protected data to be accessed over the UICC-Terminal interface. 
ETSI TS 102 221 [5] defines the range of "01" to "08" as key reference of the PIN on a multi-verification capable 
UICC. 

6.1 .7.2 Conformance requirement 

The Terminal shall support the usage of the Universal PIN as replacement PIN and the replacement procedure as 
defined in ETSI TS 102 221 [5], subclause 1 1.1.1 1, as well as the procedure to disable the replacement defined in 
ETSITS 102 221 [5], subclause 11.1.12. 

Reference: 

- ETSITS 102 221 [5], subclauses 9, 11.1.11 and 11.1.12; 

- TS 31.102 [4], clause 6. 

6.1.7.3 Test purpose 

1) To verify that the PIN replacement is supported by the Terminal correctly. 

2) To verify that the PIN replacement procedure is performed by the Terminal correctly. 

3) To verify that the procedure to disable the PIN replacement is performed by the Terminal correctly. 

6.1.7.4 Method of test 

6.1 .7.4.1 Initial conditions 

The Terminal is connected to the UICC simulator with the PIN enabled, and powered off. 
The default UICC is used. 

6.1.7.4.2 Procedure 

a) The Terminal is powered on. 

b) When the Terminal is in the "PIN check" mode, the sequence "2468#" shall be entered. 

c) The user shall initiate an MMI dependent procedure to replace the PIN by the Universal PIN. 

d) The Terminal is powered off and on and when the Terminal is in "PIN check" mode the sequence "2468#" shall 
be entered. 

e) The correct Universal PIN is entered. 

f) The user shall initiate an MMI dependent procedure to disable the replacement of the PIN by the Universal PIN. 

g) The Terminal is powered off and on and when the Terminal is in "PIN check" mode the sequence "2839#" shall 
be entered. 

h) The correct PIN is entered. 

6.1.7.5 Acceptance criteria 

1) After step b) the Terminal shall send a VERIFY PIN command to the UICC, with parameter P2 = "01". 
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2) After step c), the Terminal shall send a DISABLE PIN command to the UICC, with parameter PI ="91" and P2 = 
"01". 

3) After step d) the Terminal shall send a VERIFY PIN conmiand to the UICC, with parameter P2 = " 11" and after 
unsuccessful execution of the command the Terminal shall indicate that the PIN has not been accepted. 

4) After step e) the Terminal shall send a VERIFY PIN command to the UICC, with parameter P2 = " 1 1 " and after 
successful execution of the command the Terminal shall indicate that the PIN has been accepted. 

5) After step f), the Terminal shall send an ENABLE PIN command to the UICC, with parameter P2 = "01". 

6) After step g) the Terminal shall send a VERIFY PIN command to the UICC, with parameter P2 = "01" and after 
unsuccessful execution of the conmiand the Terminal shall indicate that the PIN has not been accepted. 

7) After step e) the Terminal shall send a VERIFY PIN command to the UICC, with parameter P2 = "01" and after 
successful execution of the command the Terminal shall indicate that the PIN has been accepted. 

6.1 .8 Change of Universal PIN 

6.1 .8.1 Definition and applicability 

The Universal PIN may be changed by the user, by entering the old and new Universal PIN. The length of the Universal 
PIN is between 4 and 8 digits. 

6.1 .8.2 Conformance requirement 

The Terminal shall support the change of PIN procedure as defined in ETSI TS 102 221 [5], subclause 11.1.10. 
Reference: 

- ETSI TS 102 221 [5], subclauses 9 and 11.1.10; 

- TS 31.102 [4], clause 6. 

6.1.8.3 Test purpose 

To verify that the PIN substitution procedure is performed correctly by the Terminal. 

6.1.8.4 Method of test 

6.1 .8.4.1 Initial conditions 

The Terminal is connected to a UICC or UICC simulator with the PIN enabled. 
The default UICC is used with the following exception: 

- The Universal PIN is used as a replacement of the PIN. 

The Terminal is powered-on, with the correct Universal PIN entered. 

6.1.8.4.2 Procedure 

a) The user shall initiate an MMI dependent procedure to change the Universal PIN to "01234567". 

b) The UE is switched off and on. 

c) When the UE is in the "PIN check" mode, the sequence "2839#" shall be entered. 

d) The UE is switched off and on. 

e) When the UE is in the "PIN check", mode the sequence "01234567#" shall be entered. 
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6.1.8.5 Acceptance criteria 

1) After step a), the Terminal shall send a CHANGE PIN command to the UICC, with the parameter P2 set to " 1 1 ". 

2) Following the successful execution of the conmiand, the UE shall give an indication that the new (Universal) 
PIN is accepted. 

3) After step c), the UE shall give an indication that the entered (Universal) PIN is not accepted. 

4) After step e), the UE shall give an indication "OK". 

6.1 .9 Unblock Universal PIN 

6.1 .9.1 Definition and applicability 

After three consecutive wrong entries of the PIN, the PIN shall become blocked. The Unblock PIN conmiand is used to 
unblock the PIN. This function may be performed whether or not the PIN is blocked. 

6.1 .9.2 Conformance requirement 

The Terminal shall support the Unblock PIN conmiand, as defined in ETSI TS 102 221 [5], subclause 11.1.13. 
Reference: 

- ETSITS 102 221 [5], subclause 11.1.13; 

- TS 31.102 [4], clause 6. 

6.1.9.3 Test purpose 

To verify that the PIN unblocking procedure is performed correctly. 

6.1.9.4 Method of test 

6.1 .9.4.1 Initial conditions 

The Terminal is connected to the UICC simulator. 
The default UICC is used. 

6.1.9.4.2 Procedure 

a) The Terminal is powered on and the correct PIN is entered. 

b) The user shall initiate an MMI dependent procedure to unblock the Universal PIN and set the new Universal PIN 
value to "1234" 

c) The Terminal is powered off and on. 

d) Enter the new PIN: "1234#". 

e) The Terminal is powered off and on. 

f) Enter a wrong PIN three times. 

g) The user shall initiate an MMI dependent procedure to unblock the Universal PIN and set the new Universal PIN 
value to "2839". 

h) The Terminal is powered off and on. 

i) Enter the new PIN: "2839#". 
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2) 


After 


step d), the Terminal shall indicate that the (Universal) PIN has been accepted. 


3) 


After 


step f), the Terminal shall indicate that the (Universal) PIN has been blocked. 


4) 


After 


step g), the Terminal shall send an UNBLOCK PIN command to the UICC, with parameter P2 = "11" 


5) 


After 


step j), the Terminal shall indicate that the (Universal) PIN has been accepted. 



6.1 .10 Entry of PIN on multi-verification capable UlCCs 

6.1 .1 0.1 Definition and applicability 

The PIN is a number used to authenticate the user to the UICC for security. Entry of the correct PIN allows PIN- 
protected data to be accessed over the UICC-Terminal interface. ETSI TS 102 221 [5] defines the range of "01" to "08" 
as key reference of the PIN on a multi- verification capable UICC. 

6.1 .1 0.2 Conformance requirement 

Following insertion of the UICC and switching on the UE, the Terminal shall check the state of the PIN. If the PIN is 
enabled, the Terminal asks the user for PIN verification. 

The VERIFY PIN function verifies the PIN presented by the Terminal to the UICC. 
Reference: 

- ETSI TS 102 221 [5], subclauses 9 and 11.1.9; 

- TS 31.102 [4], clause 6; 

- TS 22.030 [12], subclause 6.6.1. 

6.1.10.3 Test purpose 

1) To verify that the PIN verification procedure is performed by the Terminal correctly. 

2) To verify that the basic public MMI string is supported. 

3) To verify that the Terminal supports key references in the range of "01" to "08" as PIN. 

6.1.10.4 Method of test 
6.1 .1 0.4.1 Initial conditions 

The Terminal is connected to the UICC simulator with the PIN enabled, and powered off. 
The default UICC is used with the following exceptions: 

The UICC shall be configured to use "07" as the key reference of the PIN and "87" as key reference of the PIN2 with 
the following values: 

PIN 

Key reference: 07 

Logically: 8642 

Coding: B1 B2 B3 B4 B5 B6 B7 B8 
Hex 38 36 34 32 FF FF FF FF 
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Unblock PIN 
Key reference 07 
Logically: 



64534231 



Coding: 
Hex 



B1 
36 



B2 
34 



B3 
35 



84 
33 



B5 
34 



B6 
32 



87 
33 



B8 
31 



PIN2 

Key reference 87 
Logically: 



9753 



Coding: B1 
Hex 39 



82 
37 



B3 
35 



B4 
33 



B5 
FF 



B6 
FF 



B7 
FF 



B8 
FF 



Unblock PIN2 
Key reference 87 
Logically: 



57687980 



Coding: B1 
Hex 35 



B2 
37 



B3 
36 



B4 
38 



B5 
37 



B6 
39 



B7 
38 



B8 
30 



6.1.10.4.2 Procedure 

a) The Terminal is powered on. 

b) When the UE is in the "PIN check" mode, the sequence "8642#" shall be entered. 

6.1 .1 0.5 Acceptance criteria 

1) After step b) the Terminal shall send a VERIFY PIN conmiand to the UICC, with parameter P2 = "07". 

2) After step b) the UE shall give an indication "OK", following a successful execution of the command. 

6.1 .1 1 Change of PIN on multi-verification capable UlCCs 

6.1 .1 1 .1 Definition and applicability 

The PIN may be changed by the user, by entering the old and new PIN. The length of the PIN is between 4 and 8 digits. 
ETSI TS 102 221 [5] defines the range of "01" to "08" as key reference of the PIN on a multi-verification capable 
UICC. 

6.1 .1 1 .2 Conformance requirement 

The Terminal shall support the change of PIN procedure as defined in TS 102 221 [5], subclause 11.1.10. 
Reference: 

- ETSI TS 102 221 [5], subclauses 9 and 11.1.10; 

- TS 31.102 [4], clause 6; 

- TS 22.030 [12], subclause 6.6.2. 
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6.1.11.3 Test purpose 

1) To verify that the PIN substitution procedure is performed correctly by the Terminal. 

2) To verify that the basic public MMI string is supported. 

3) To verify that the Terminal supports key references in the range of "01" to "08" as PIN. 



6.1.11.4 



Method of test 



6.1 .1 1 .4.1 Initial conditions 

The Terminal is connected to the UICC simulator with the PIN enabled. 
The default UICC is used with the following exceptions: 

The UICC shall be configured to use "07" as the reference of the PIN and "87" as reference of the PIN2 with the 
following values: 

PIN 

Key reference: 07 
Logically: 



Coding: 
Hex 



B1 
38 



8642 

B2 
36 



B3 
34 



84 
32 



B5 
FF 



B6 
FF 



87 
FF 



B8 
FF 



Unblock PIN 
Key reference 07 
Logically: 



64534231 



Coding: 
Hex 



B1 
36 



82 
34 



B3 
35 



B4 
33 



B5 
34 



B6 
32 



B7 
33 



B8 
31 



PIN2 

Key reference 87 
Logically: 

Coding: B1 
Hex 39 



9753 

B2 
37 



B3 
35 



B4 
33 



B5 
FF 



B6 
FF 



B7 
FF 



B8 
FF 



Unblock PIN2 
Key reference 87 
Logically: 



Coding: 
Hex 



B1 
35 



57687980 



B2 
37 



B3 
36 



B4 
38 



B5 
37 



B6 
39 



B7 
38 



B8 
30 



The Terminal is powered-on, with the correct PIN entered. 

6.1.11.4.2 Procedure 

a) Enter "**04*8642*01234567*01234567#" or initiate an equivalent MMI dependent procedure to change the 
PIN from '8642' to '01234567'.. 
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b) The UE is switched off and on. 

c) When the UE is in the "PIN check" mode, the sequence "8642#" shall be entered. 

d) The UE is switched off and on. 

e) When the UE is in the "PIN check", mode the sequence "01234567#" shall be entered. 

6.1.11.5 Acceptance criteria 

1) After step a), the Terminal shall send a CHANGE PIN command to the UICC, with the parameter P2 set to "07". 

2) Following the successful execution of the command, the UE shall give an indication that the new PIN is 
accepted. 

3) After step c), the UE shall give an indication that the entered PIN is not accepted. 
3) After step e), the UE shall give an indication "OK". 

6.1.12 Unblock PIN on multi-verification capable UlCCs 

6.1.12.1 Definition and applicability 

After three consecutive wrong entries of the PIN, the PIN shall become blocked. The Unblock PIN conmiand is used to 
unblock the PIN. This function may be performed whether or not the PIN is blocked. ETSI TS 102 221 [5] defines the 
range of "01" to "08" as key reference of the PIN on a multi-verification capable UICC. 

6.1.12.2 Conformance requirement 

The Terminal shall support the Unblock PIN conmiand, as defined in ETSI TS 102 221 [5], subclause 11.1.13. 
Reference: 

- ETSI TS 102 221 [5], subclauses 9 and 11.1.13; 

- TS 31.102 [4], clause 6; 

- TS 22.030 [12], subclause 6.6.3. 

6.1.12.3 Test purpose 

1) To verify that the PIN unblocking procedure is performed correctly. 

2) To verify that the basic public MMI string is supported. 

3) To verify that the Terminal supports key references in the range of "01" to "08" as PIN. 

6.1.12.4 Method of test 
6.1 .12.4.1 Initial conditions 

The Terminal is connected to the UICC simulator. 

The default UICC is used with the following exceptions: 

The UICC shall be configured to use "07" as the reference of the PIN and "87" as reference of the PIN2 with the 
following values: 

PIN 

Key reference: 07 

Logically: 8642 
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Coding: B1 
Hex 38 



B2 
36 



B3 
34 



84 
32 



B5 
FF 



B6 
FF 



87 
FF 



B8 
FF 



Unblock PIN 
Key reference 07 
Logically: 



Coding: 
Hex 



B1 
36 



64534231 



82 
34 



B3 
35 



B4 
33 



85 
34 



B6 
32 



B7 
33 



B8 
31 



PIN2 

Key reference 87 
Logically: 



Coding: 
Hex 



B1 
39 



9753 

B2 
37 



B3 
35 



B4 
33 



B5 
FF 



B6 
FF 



B7 
FF 



B8 
FF 



Unblock PIN2 

Key reference 87 
Logically: 



Coding: 
Hex 



B1 
35 



57687980 



B2 
37 



B3 
36 



B4 
38 



B5 
37 



B6 
39 



B7 
38 



B8 
30 



6.1.12.4.2 Procedure 

Sequence A: 

a) The Terminal is powered on and the correct PIN is entered. 

b) Enter "**05*64534231*1234*1234#" 

c) The Terminal is powered off and on. 

d) Enter the new PIN: "1234#". 

e) The Terminal is powered off and on. 

f) Enter a wrong PIN three times. 

g) Enter "**05*64534231*8642*8642#". 

h) The Terminal is powered off and on. 

i) Enter the new PIN: "8642#". 
Sequence B: 

a) The Terminal is powered on. 

b) Enter a wrong PIN three times. 

c) The user shall initiate a MMI dependent procedure to unblock the PIN with unblock code '64534231' and a new 
PIN '8642'. 



d) The Terminal is powered off and on. 
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e) Enter the new PIN: "8642#". 

6.1 .12.5 Acceptance criteria 

Sequence A: 

1) After step b), the Terminal shall send an UNBLOCK PIN command to the UICC, with parameter P2 = "07". 

2) After step d), the Terminal shall indicate that the PIN has been accepted. 

3) After step f), the Terminal shall indicate that the PIN has been blocked. 

4) After step g), the Terminal shall send an UNBLOCK PIN command to the UICC, with parameter P2 = "07". 

5) After step j), the Terminal shall indicate that the PIN has been accepted. 
Sequence B: 

1) After step b), the Terminal shall indicate that the PIN has been blocked. 

2) After step c), the Terminal shall send an UNBLOCK PIN command to the UICC, with parameter P2 = "07". 

3) After step e), the Terminal shall indicate that the PIN has been accepted. 

6.1.13 Entry of PIN2 on multi-verification capable UlCCs 

6.1 .1 3.1 Definition and applicability 

The PIN2 is a number used to authenticate the user to the UICC for security. Entry of the correct PIN2 allows 
PIN2-protected data to be accessed over the UICC-Terminal interface. ETSI TS 102 221 [5] defines the range of "81" to 
"88" as key reference of the PIN2 on a multi-verification capable UICC. 

6.1 .1 3.2 Conformance requirement 

Before allowing the access to PIN2 protected data, the Terminal shall ask the user for PIN2 verification. Only after 
presenting the PIN2, the user shall get access to these data. 

The VERIFY PIN function verifies the PIN2 presented by the Terminal to the UICC. 
Reference: 

- ETSI TS 102 221 [5], 9 and subclause 11.1.9; 

- TS 31.102 [4], clause 6; 

- TS 22.030 [12], subclause 6.6.1. 

6.1.13.3 Test purpose 

1) To verify that the PIN2 verification procedure is performed by the Terminal correctly. 

2) To verify that the basic public MMI string is supported. 

3) To verify that the Terminal supports key references in the range of "81" to "88" as PIN2. 

6.1.13.4 Method of test 
6.1.13.4.1 Initial conditions 

The Terminal is connected to the UICC simulator with the PIN enabled, and powered off. 
The default UICC is used with the following exceptions: 
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The UICC shall be configured to use "07" as the reference of the PIN and "87" as reference of the PIN2 with the 
following values: 

PIN 

Key reference: 07 

Logically: 8642 



Coding: B1 
Hex 38 



B2 
36 



B3 
34 



84 
32 



B5 
FF 



B6 
FF 



87 
FF 



B8 
FF 



Unblock PIN 
Key reference 07 
Logically: 

Coding: B1 
Hex 36 



64534231 



82 
34 



B3 
35 



B4 
33 



B5 
34 



B6 
32 



B7 
33 



B8 
31 



PIN2 

Key reference 87 
Logically: 



Coding: 
Hex 



B1 
39 



9753 

B2 
37 



B3 
35 



B4 
33 



B5 
FF 



B6 
FF 



B7 
FF 



B8 
FF 



Unblock PIN2 
Key reference 87 
Logically: 

Coding: B1 
Hex 35 



57687980 



B2 
37 



B3 
36 



B4 
38 



B5 
37 



B6 
39 



B7 
38 



B8 
30 



NOTE: To perform the UPDATE FDN data (as described in the procedure below), the default FDN UICC may be 
used. In this case the above mentioned exceptions shall apply. 

6.1.13.4.2 Procedure 

a) The Terminal is powered on and the correct PIN is entered. 

b) The access to a PIN2 protected data field shall be performed (e.g. UPDATE FDN) 

c) When the UE is in the "PIN2 check" mode, the sequence "9753#" shall be entered. 

6.1 .13.5 Acceptance criteria 

1) After step b) the Terminal shall send a VERIFY PIN command to the UICC, with parameter P2 = "87". 

2) After step b) the UE shall give an indication "OK", following a successful execution of the command. 
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6.1 .14 Change of PIN2 on multi-verification capable UlCCs 

6.1.14.1 Definition and applicability 

The PIN2 may be changed by the user, by entering the old and new PIN2. The length of the PIN2 is between 4 and 8 
digits. ETSI TS 102 221 [5] defines the range of "81" to "88" as key reference of the PIN2 on a multi-verification 
capable UICC. 

6.1.14.2 Conformance requirement 

The Terminal shall support the change of PIN2 procedure as defined in ETSI TS 102 221 [5], subclause 11.1.10. 
Reference: 

- ETSI TS 102 221 [5], subclauses 9 and 11.1.10; 

- TS 31.102 [4], clause 6; 

- TS 22.030 [12], subclause 6.6.2. 

6.1.14.3 Test purpose 

1) To verify that the PIN2 substitution procedure is performed correctly by the Terminal. 

2) To verify that the basic public MMI string is supported. 

3) To verify that the Terminal supports key references in the range of "81" to "88" as PIN2. 

6.1.14.4 Method of test 
6.1.14.4.1 Initial conditions 

The Terminal is connected to the UICC simulator with the PIN2 enabled. 
The default UICC is used with the following exceptions: 

The UICC shall be configured to use "07" as the reference of the PIN and "87" as reference of the PIN2 with the 
following values: 

PIN 

Key reference: 07 
Logically: 8642 

Coding: B1 B2 B3 84 B5 B6 B7 B8 
Hex 38 36 34 32 FF FF FF FF 

Unblock PIN 

Key reference 07 
Logically: 64534231 

Coding: B1 B2 B3 B4 B5 B6 B7 B8 
Hex 36 34 35 33 34 32 33 31 

PIN2 

Key reference 87 
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Logically: 9753 

Coding: B1 B2 B3 B4 B5 B6 B7 B8 
Hex 39 37 35 33 FF FF FF FF 



Unblock PIN2 

Key reference 87 
Logically: 57687980 

Coding: B1 B2 B3 B4 B5 B6 B7 B8 
Hex 35 37 36 38 37 39 38 30 



NOTE: To perform the UPDATE FDN data (as described in the procedure below), the default FDN UICC may be 
used. In this case the above mentioned exceptions shall apply. 

The Terminal is powered-on, with the correct PIN entered. 

6.1.14.4.2 Procedure 

a) Enter "**042*9753*12345678*12345678#" or initiate an equivalent MMI dependent procedure to change PIN2 
from '9753' to '12345678'. 

b) The UE is switched off and on and the correct PIN is entered. 

c) The access to a PIN2 protected data field shall be performed (e.g. UPDATE FDN). 

d) When the UE is in the "PIN2 check" mode, the sequence "9753#" shall be entered. 

e) The UE is switched off and on and the correct PIN is entered. 

f) The access to a PIN2 protected data field shall be performed (e.g. UPDATE FDN). 

g) When the UE is in the "PIN2-check", mode the sequence "12345678#" shall be entered. 

6.1.14.5 Acceptance criteria 

1) After step a), the Terminal shall send a CHANGE PIN2 command to the UICC, with the parameter P2 set to 
"87". 

2) Following the successful execution of the conmiand, the UE shall give an indication that the new PIN2 is 
accepted. 

3) After step d), the UE shall give an indication that the entered PIN2 is not accepted. 
3) After step g), the UE shall give an indication "OK". 

6.1.15 Unblock PIN2 on multi-verification capable UlCCs 

6.1 .1 5.1 Definition and applicability 

After three consecutive wrong entries of the PIN2, the PIN2 shall become blocked. The Unblock PIN2 conmiand is 
used to unblock the PIN2. This function may be performed whether or not the PIN2 is blocked. ETSI TS 102 221 [5] 
defines the range of "81" to "88" as key reference of the PIN2 on a multi-verification capable UICC. 

6.1 .1 5.2 Conformance requirement 

The Terminal shall support the Unblock PIN2 conmiand, as defined in ETSI TS 102 221 [5], subclause 11.1.13. 
Reference: 
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- ETSI TS 102 221 [5], subclauses 9 and 11.1.13; 

- TS 31.102 [4], clause 6; 

- TS 22.030 [12], subclause 6.6.3. 

6.1.15.3 Test purpose 

1) To verify that the PIN2 unblocking procedure is performed correctly. 

2) To verify that the basic public MMI string is supported. 

3) To verify that the Terminal supports key references in the range of "81" to "88" as PIN2. 



6.1.15.4 



Method of test 



6.1 .15.4.1 Initial conditions 

The Terminal is connected to the UICC simulator. 

The default UICC is used with the following exceptions: 

The UICC shall be configured to use "07" as the reference of the PIN and "87" as reference of the PIN2 with the 
following values: 

PIN 

Key reference: 07 

Logically: 8642 



Coding: 
Hex 



B1 
38 



B2 
36 



B3 
34 



84 
32 



B5 
FF 



B6 
FF 



87 
FF 



B8 
FF 



Unblock PIN 
Key reference 07 
Logically: 



64534231 



Coding: 
Hex 



B1 
36 



82 
34 



B3 
35 



B4 
33 



B5 
34 



B6 
32 



B7 
33 



B8 
31 



PIN2 

Key reference 87 
Logically: 



9753 



Coding: 
Hex 



B1 
39 



B2 
37 



B3 
35 



B4 
33 



B5 
FF 



B6 
FF 



B7 
FF 



B8 
FF 



Unblock PIN2 
Key reference 87 
Logically: 



57687980 



Coding: 
Hex 



B1 
35 



B2 
37 



B3 
36 



B4 
38 



B5 
37 



B6 
39 



B7 
38 



B8 
30 
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NOTE: To perform the UPDATE FDN data (as described in the procedure below), the default FDN UICC may be 
used. In this case the above mentioned exceptions shall apply. 

6.1.15.4.2 Procedure 

Sequence A: 

a) The Terminal is powered on and the correct PIN is entered. 

b) Enter "**052*57687980*1234*1234#" 

c) The Terminal is powered off and on and the correct PIN is entered. 

d) The access to a PIN2 protected data field shall be performed (e.g. UPDATE FDN). 

e) Enter the new PIN2: "1234#". 

f) The Terminal is powered off and on and the correct PIN is entered. 

g) The access to a PIN2 protected data field shall be performed (e.g. UPDATE FDN). 

h) Enter a wrong PIN2 three times. 

i) Enter "**052*57687980*9753*9753#". 

j) The Terminal is powered off and on and the correct PIN is entered, 

k) The access to a PIN2 protected data field shall be performed (e.g. UPDATE FDN). 

1) Enter the new PIN2: "9753#". 
Sequence B: 

a) The Terminal is powered on . 

b) Enter a wrong PIN2 three times. 

c) The user shall initiate a MMI dependent procedure to unblock the PIN2 with unblock code '57687980' and a new 
PIN2 '9753'. 

d) The Terminal is powered off and on and the correct PIN is entered. 

e) The access to a PIN2 protected data field shall be performed (e.g. UPDATE FDN). 

f) Enter the new PIN2: "9753#". 



6.1.15.5 Acceptance criterias 

Sequence A: 



1) 


After 


step 


b), the Terminal shall send an UNBLOCK PIN command to the UICC, with parameter P2 = "87" 


2) 


After 


step 


e), the Terminal shall indicate that the PIN2 has been accepted. 


3) 


After 


step 


h), the Terminal shall indicate that the PIN2 has been blocked. 


4) 


After 


step 


i), the Terminal shall send an UNBLOCK PIN command to the UICC, with parameter P2 = "87". 


5) 


After 


step 


1), the Terminal shall indicate that the PIN2 has been accepted. 



Sequence B: 

1) After step b), the Terminal shall indicate that the PIN2 has been blocked. 

2) After step c), the Terminal shall send an UNBLOCK PIN command to the UICC, with parameter P2 = "87". 

3) After step f), the Terminal shall indicate that the PIN2 has been accepted. 
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6.1 .16 Replacement of PIN with key reference "07" 

6.1 .1 6.1 Definition and applicability 

The Universal PIN may be used to replace a PIN used to authenticate the user to the UICC for security. In this case 
entry of the correct Universal PIN allows PIN-protected data to be accessed over the UICC-Terminal interface. 

6.1 .1 6.2 Conformance requirement 

The Terminal shall support the usage of the Universal PIN as replacement PIN and the replacement procedure as 
defined in ETSI TS 102 221 [5], subclause 1 1.1.1 1, as well as the procedure to disable the replacement defined in 
ETSITS 102 221 [5], subclause 11.1.12. 

Reference: 

- ETSITS 102 221 [5], subclauses 9, 11.1.11 and 11.1.12; 

- TS 31.102 [4], clause 6. 

6.1.16.3 Test purpose 

1) To verify that the PIN replacement is supported by the Terminal correctly. 

2) To verify that the PIN replacement procedure is performed by the Terminal correctly. 

3) To verify that the procedure to disable the PIN replacement is performed by the Terminal correctly. 

4) To verify that the Terminal supports key references in the range of "01" to "08" as PIN. 

6.1.16.4 Method of test 
6.1 .1 6.4.1 Initial conditions 

The Terminal is connected to the UICC simulator with the PIN enabled, and powered off. 
The default UICC is used with the following exceptions: 

The UICC shall be configured to use "07" as the reference of the PIN and "87" as reference of the PIN2 with the 
following values: 

PIN 

Key reference: 07 

Logically: 8642 

Coding: B1 B2 B3 B4 B5 B6 B7 B8 
Hex 38 36 34 32 FF FF FF FF 

Unblock PIN 
Key reference 07 

Logically: 64534231 

Coding: B1 B2 B3 B4 B5 B6 B7 B8 
Hex 36 34 35 33 34 32 33 31 

PIN2 

Key reference 87 
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Logically: 9753 

Coding: B1 B2 B3 B4 B5 B6 B7 B8 
Hex 39 37 35 33 FF FF FF FF 



Unblock PIN2 
Key reference 87 

Logically: 57687980 

Coding: B1 B2 B3 B4 B5 B6 B7 B8 
Hex 35 37 36 38 37 39 38 30 



6.1.16.4.2 Procedure 

a) The Terminal is powered on. 

b) When the Terminal is in the "PIN check" mode, the sequence "8642#" shall be entered. 

c) The user shall initiate an MMI dependent procedure to replace the PIN by the Universal PIN. 

d) The Terminal is powered off and on and when the Terminal is in "PIN check" mode the sequence "8642#" shall 
be entered. 

e) The correct Universal PIN is entered. 

f) The user shall initiate an MMI dependent procedure to disable the replacement of the PIN by the Universal PIN. 

g) The Terminal is powered off and on and when the Terminal is in "PIN check" mode the sequence "2839#" shall 
be entered. 

h) The correct PIN is entered. 

6.1.16.5 Acceptance criteria 

1) After step b) the Terminal shall send a VERIFY PIN command to the UICC, with parameter P2 = "07". 

2) After step c), the Terminal shall send a DISABLE PIN command to the UICC, with parameter PI ="91" and P2 = 
"07". 

3) After step d) the Terminal shall send a VERIFY PIN command to the UICC, with parameter P2 = " 11" and after 
unsuccessful execution of the command the Terminal shall indicate that the PIN has not been accepted. 

4) After step e) the Terminal shall send a VERIFY PIN command to the UICC, with parameter P2 = " 11 " and after 
successful execution of the command the Terminal shall indicate that the PIN has been accepted. 

5) After step f), the Terminal shall send an ENABLE PIN command to the UICC, with parameter P2 = "07". 

6) After step g) the Terminal shall send a VERIFY PIN command to the UICC, with parameter P2 = "07" and after 
unsuccessful execution of the command the Terminal shall indicate that the PIN has not been accepted. 

7) After step e) the Terminal shall send a VERIFY PIN command to the UICC, with parameter P2 = "07" and after 
successful execution of the command the Terminal shall indicate that the PIN has been accepted. 
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6.2 Fixed Dialling Numbers (FDN) handling 

6.2.1 Terminal and USIM with FDN enabled, EFadn readable and 
updateable 

6.2.1 .1 Definition and applicability 

Fixed Dialling Numbers (FDN) is a service defined for the USIM. An enabled FDN service results in call restrictions 
for the UE. The call restrictions are controlled by the Terminal. To ascertain the type of USIM and state of FDN the UE 
runs the FDN capability request procedure during UICC-Terminal initialisation. During the initialisation the Terminal 
shall request the Emergency call codes of the USIM EFecc- At the time an emergency call is setup using the emergency 
call code read from the EFecc? the UE shall use the category of the emergency service indicated. 

6.2.1 .2 Conformance requirement 

1) Recognising the state of the USIM (FDN enabled) the UE shall perform the UICC initialisation procedure as 
specified. 

2) The UE allows call set-up to a directory number as stored in EFfdn- 

3) The UE allows call set-up to a directory number as stored in EFfdn and extended by digits in the end. 

4) The UE does not allow call set-up to a directory number stored in EFfdn but with missing digits at the end. 

5) The UE does not allow call set-up to a directory number having no reference in EFfdn- 

6) The UE does not allow call set-up of an emergency call using the emergency numbers stored in the Terminal 
except "112", "911", the emergency numbers stored on the SIMAJSIM and emergency numbers downloaded 
from the serving network (if any). 

7) The UE allows call set-up of an emergency call using the emergency number stored in the USIM. 
Reference: 

- TS 22.101 [11], clauses 8 and A.24; 

- TS 31.102 [4], subclauses 4.4.2, 4.2.24, 5.1.1 and 5.3.2; 

- TS 24.008 [16], subclause 10.5.4.33. 

6.2.1.3 Test purpose 

1) To verify that the Terminal allows call set-up to a FDN number. 

2) To verify that the Terminal allows call set-up to a FDN number extended by some digits in the end. 

3) To verify that the Terminal rejects call set-up to number having no reference in EFfdn- 

4) To verify that the Terminal rejects call set-up to a FDN number not completely corresponding to an entry in 
EFfdn- 

5) To verify that the Terminal does not allow emergency call set-up using the emergency number stored in the 
Terminal except "112", "911", the emergency numbers stored on the SIMAJSIM and emergency numbers 
downloaded from the serving network (if any). 

6) To verify that the Terminal allows emergency call set-up using the emergency number stored in the UISM. 
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6.2.1.4 Method of test 

6.2.1 .4.1 Initial conditions 

The USS (in case of a Terminal accessing UTRAN)/ SS (in case of a Terminal accessing GERAN) transmits on the 
BCCH, with the following network parameters 

- Attach/detach: disabled. 

- LAI (MCC/MNC/LAC): 246/081/0001. 

- Access control: unrestricted. 

The default FDN UICC with FDN service enabled and EFadn readable and updateable is installed into the Terminal. 

The following expection applies: 

EFecc (Emergency Call Codes) 

Logically: Emergency call code: "122"; 

Emergency call code alpha identifier: "TEST"; 
Emergency call Service Category: RFU. 

Coding: B1 B2 B3 B4 B5 B6 B7 B8 

Hex 21 F2 FF 54 45 53 54 00 

6.2.1.4.2 Procedure 

a) The UE is powered on and PIN is entered. 

b) Using the MMI a call set-up to the fixed dialling number 1 (record 1) is attempted. 

c) Using the MMI a call set-up to the fixed dialling number 2 (record 2) extended by "123" in the end is attempted. 

d) Using the MMI a call set-up to a number which is equal to the fixed dialling number 3 (record 3) without the last 
digit is attempted, e.g. by recalling the fixed dialling number 3 and deleting the last digit (only in display). 

e) Using the MMI a call set-up to the number "1234567" is attempted. 

f) Using the MMI an emergency call set-up is attempted using an emergency call code stored in the Terminal, but 
not "1 12", "911" nor one of the emergency numbers stored on the SIM/USIM emergency numbers downloaded 
from the serving network (if any). 

g) Using the MMI an emergency call set-up is attempted using either " 112", "911" or an emergency number 
downloaded from the serving network (if any). 

h) Using the MMI an emergency call set-up is attempted using the emergency call code stored in the USIM 
(i.e. "122"). 

NOTE: For step f) one of the emergency call codes according to TS 22.101 [11], subclause 10.1, except "1 12" 
and "911", shall be used (i.e. "000", "08", "110", "118", "119" or "999"). 

6.2.1 .5 Acceptance criteria 

1) After step a) the UE is registered and in idle state. 

2) After steps b) and c) the UE shall allow call set-up and send the requested number across the air interface. 

3) After steps d), e) and f) the UE shall prevent call set-up. 

4) After steps g) and h) the UE shall allow emergency call by indicating the call setup as "Emergency Call". 
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6.2.2 Terminal and USIM with FDN disabled 

6.2.2.1 Definition and applicability 

Fixed Dialling Numbers (FDN) is a service defined for the USIM. An enabled FDN service results in call restrictions 
for the UE. Only directory numbers which are stored in the EFfdn may be dialled by the UE. The call restrictions are 
controlled by the Terminal. To ascertain the type of USIM and state of FDN the UE runs the FDN capability request 
procedure during UICC-Terminal initialisation. Deactivation of the service by the subscriber is possible under the 
control of PIN2 and switches the USIM into a "normal", non restrictive USIM. 

6.2.2.2 Conformance requirement 

1) Recognising the state of the USIM (FDN disabled) the UE correctly performs the UICC initialisation procedure. 

2) The UE allows call set-up to a directory number as stored in EFfdn- 

3) The UE allows call set-up to a directory number as stored in EFadn- 

4) The UE allows call set-up to a directory number given in manually. 
Reference: 

- R99: TS 22.101 [11], clauses 8 and A.24 

- Rel-4: TS 22.101 [11], clauses 9 and A.25 

- Rel-5, Rel-6: TS 22.101 [11], clauses 10 and A.25; 

- TS 31.102 [4], subclauses 4.4.2.3, 4.2.24, 4.2.47, 5.1.1 and 5.3.2. 

6.2.2.3 Test purpose 

1) To verify that the Terminal as a result of the state of the USIM correctly performs the UICC-Terminal 
initialisation procedure. 

2) To verify that the Terminal allows call set-up to a FDN number. 

3) To verify that the Terminal allows call set-up to a ADN number. 

4) To verify that the Terminal allows call set-up to manually given number. 

6.2.2.4 Method of test 
6.2.2.4.1 Initial conditions 

The USS (in case of a Terminal accessing UTRAN) /SS (in case of a Terminal accessing GERAN) transmits on the 
BCCH, with the following network parameters: 

- Attach/detach: disabled. 

- LAI (MCC/MNC/LAC): 246/081/0001. 

- Access control: unrestricted. 
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The default FDN UICC is used with the following exception: 

EFest (Enable Service Table) 

Logically: Fixed Dialling Numbers disabled. 

Barred Dialling Numbers disabled. 
APN Control list (ACL) disabled. 

Coding: B1 
binary 0000 0000 

The UICC is installed into the Terminal and the UE is powered on. 

6.2.2.4.2 Procedure 

a) Using the MMI a call set-up to the fixed dialling number 1 is attempted. 

b) Using the MMI a call set-up to the abbreviated dialling number 1 is attempted. 

c) Using the MMI a call set-up to the number "1234567" is attempted. 

6.2.2.5 Acceptance criteria 

After steps a), b) and c) the UE shall allow call set-up and send the requested number across the air interface. 

6.2.3 Enabling, disabling and updating of FDN 

6.2.3.1 Definition and applicability 

FDN may be enabled and disabled by the subscriber under control of PIN2. Fixed dialling numbers are read with PIN 
and updated under control of PIN2. 

6.2.3.2 Conformance requirement 

1) Recognising the state of the USIM (FDN enabled) the UE shall perform the UICC initialisation procedure as 
specified. 

2) The UE shall allow updating of EFfdn by the use of PIN2. 

3) The UE provides means to disable the FDN service by the use of PIN2. 

4) The UE shall allow the use of EFadn after disabling of FDN. 
Reference: 

- R99: TS 22.101 [11], clauses 8 and A.24 

- Rel-4: TS 22.101 [11], clauses 9 and A.25 

- Rel-5, Rel-6: TS 22.101 [11], clause 10 and A.25; 

- TS 31.102 [4], subclauses 4.4.2.3, 4.2.24, 4.2.47, 5.1.1 and 5.3.2. 

6.2.3.3 Test purpose 

1) To verify that the Terminal correctly performs the update of a number in EFfdn- 

2) To verify that the Terminal correctly disables FDN service. 

3) To verify that the Terminal recognises disabling of FDN and allows access to EFadn- 



ETSI 



3GPP TS 31.121 version 10.2.1 Release 10 



124 



ETSI TS 131 121 VI 0.2.1 (2011-11) 



6.2.3.4 Method of test 

6.2.3.4.1 Initial conditions 

The USS (in case of a Terminal accessing UTRAN)/SS (in case of a Terminal accessing GERAN) transmits on the 
BCCH, with the following network parameters 

- Attach/detach: disabled. 

- LAI (MCC/MNC/LAC): 246/081/0001. 

- Access control: unrestricted. 

The default FDN UICC with FDN service enabled is installed into the Terminal. 

6.2.3.4.2 Procedure 

a) The UE is powered on and PIN is entered. 

b) Using the MMI the directory number "+876543210" is stored in EFfdn as fixed dialling number 1 (record 1). 
The alpha identifier is not changed. On request of the UE PIN2 is entered. 

c) Using the MMI the FDN disabling procedure is performed. On request of the UE PIN2 is entered. 

d) Using the MMI a call set-up to the abbreviated dialling number 1 (record 1) is attempted. 

e) The UE is soft-powered down. 

6.2.3.5 Acceptance criteria 

1) After step a) the UE is registered and in idle state. 

2) After step c) the UE shall indicate that the FDN disabling procedure has been successful. 

3) After step d) the UE shall allow call set-up and send the requested number across the air interface. 

4) After step e) record 1 in EFfdn » shall contain the following values: 





B1 


B2 


B3 


B4 


B5 


B6 


B7 


B8 


B9 


BIO 


B11 


B12 


B13 


Hex 


46 


44 


4E 


31 


31 


31 


06 


91 


78 


56 


34 


12 


FO 




B14 


B15 


B16 


B17 


B18 


B19 


B20 
















FF 


FF 


FF 


FF 


FF 


FF 


FF 















6.2.4 Terminal and USIM with FDN enabled, EFadn readable and 
updateable (Rel-4 and onwards) 

6.2.4.1 Definition and applicability 

Fixed Dialling Numbers (FDN) is a service defined for the USIM. An enabled FDN service results in call restrictions 
for the UE. The call restrictions are controlled by the Terminal. To ascertain the type of USIM and state of FDN the UE 
runs the FDN capability request procedure during UICC-Terminal initialisation. During the initialisation the Terminal 
shall request the Emergency call codes of the USIM EFecc- At the time an emergency call is setup using the emergency 
call code read from the EFecc» the UE shall use the category of the emergency service indicated. 

6.2.4.2 Conformance requirement 

1) Recognising the state of the USIM (FDN enabled) the UE shall perform the UICC initialisation procedure as 
specified. 

2) The UE allows call set-up to a directory number as stored in EFfdn- 
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3) The UE allows call set-up to a directory number as stored in EFfdn and extended by digits in the end. 

4) The UE does not allow call set-up to a directory number stored in EFfdn but with missing digits at the end. 

5) The UE does not allow call set-up to a directory number having no reference in EFfdn- 

6) The UE does not allow call set-up of an emergency call using the emergency numbers stored in the Terminal 
except "112", "911", the emergency numbers stored on the SIMAJSIM and emergency numbers downloaded 
from the serving network (if any). 

7) The UE allows call set-up of an emergency call using the emergency number stored in the USIM. 

8) The UE shall indicate the emergency service category as "Mountain Rescue", when using the emergency number 
stored in the USIM. 

Reference: 

- Rel-4: TS 22.101 [11], clauses 9 and A.25 

- Rel-5, Rel-6: TS 22.101 [11], clauses 10 and A.25; 

- TS 31.102 [4], subclauses 4.4.2, 4.2.24, 5.1.1 and 5.3.2; 

- TS 24.008 [16], subclause 10.5.4.33. 

6.2.4.3 Test purpose 

1) To verify that the Terminal allows call set-up to a FDN number. 

2) To verify that the Terminal allows call set-up to a FDN number extended by some digits in the end. 

3) To verify that the Terminal rejects call set-up to number having no reference in EFfdn- 

4) To verify that the Terminal rejects call set-up to a FDN number not completely corresponding to an entry in 
EFfdn- 

5) To verify that the Terminal does not allow emergency call set-up using the emergency number stored in the 
Terminal except "112", "911", the emergency numbers stored on the SIMAJSIM and emergency numbers 
downloaded from the serving network (if any). 

6) To verify that the Terminal allows emergency call set-up using the emergency number stored in the UISM. 

7) To verify that the Terminal reads correctly the emergency service category. 

6.2.4.4 Method of test 

6.2.4.4.1 Initial conditions 

The USS (in case of a Terminal accessing UTRAN)/ SS (in case of a Terminal accessing GERAN) transmits on the 
BCCH, with the following network parameters 

- Attach/detach: disabled. 

- LAI (MCC/MNC/LAC): 246/081/0001. 

- Access control: unrestricted. 

The default FDN UICC with FDN service enabled and EFadn readable and updateable is installed into the Terminal. 

6.2.4.4.2 Procedure 

a) The UE is powered on and PIN is entered. 

b) Using the MMI a call set-up to the fixed dialling number 1 (record 1) is attempted. 
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c) Using the MMI a call set-up to the fixed dialling number 2 (record 2) extended by "123" in the end is attempted. 

d) Using the MMI a call set-up to a number which is equal to the fixed dialling number 3 (record 3) without the last 
digit is attempted, e.g. by recalling the fixed dialling number 3 and deleting the last digit (only in display). 

e) Using the MMI a call set-up to the number "1234567" is attempted. 

f) Using the MMI an emergency call set-up is attempted using an emergency call code stored in the Terminal, but 
not "112", "911" nor one of the emergency numbers stored on the SIM/USIM emergency numbers downloaded 
from the serving network (if any). 

g) Using the MMI an emergency call set-up is attempted using either "1 12", "911" or an emergency number 
downloaded from the serving network (if any). 

h) Using the MMI an emergency call set-up is attempted using the emergency call code stored in the USIM 
(i.e. "122"). 

NOTE: For step f) one of the emergency call codes according to TS 22.101 [11], subclause 10.1, except "1 12" 
and "911", shall be used (i.e. "000", "08", "110", "118", "119" or "999"). 

6.2.4.5 Acceptance criteria 

1) After step a) the UE is registered and in idle state. 

2) After steps b) and c) the UE shall allow call set-up and send the requested number across the air interface. 

3) After steps d), e) and f) the UE shall prevent call set-up. 

4) After steps g) and h) the UE shall allow emergency call by indicating the call setup as "Emergency Call". 

5) After step h) the UE shall send the emergency service category correctly as "Mountain Rescue". 

6.3 Void 

6.4 Advice of charge (AoC) handling 
6.4.1 AoC not supported by USIM 

6.4.1 .1 Definition and applicability 

If the Terminal under test supports Advice of Charge Charging, it shall still look at the capability of the USIM, before 
responding to any AoCC information from the network. 

6.4.1 .2 Conformance requirement 

1) An UE not supporting AoCC and in the outgoing call / U4 call delivered state, on receipt of a CONNECT 
message containing AoCC information shall acknowledge the CONNECT message but ignore and not 
acknowledge the AoCC information sent within the CONNECT. 

2) An UE not supporting AoCC and in the outgoing call / U4 call delivered state, on receipt of a FACILITY 
message containing AoCC information shall ignore and not acknowledge the AoCC information sent within the 
FACILITY. 

3) An UE not supporting AoCC and in the incoming call / U9 call confirmed state, on receipt of a FACILITY 
message containing AoCC information shall ignore and not acknowledge the AoCC information sent within the 
FACILITY. 

4) An UE not supporting AoCC and in the UIO call active state, on receipt of a FACILITY message containing 
AoCC information, shall ignore and not acknowledge the AoCC information sent within the FACILITY. 

References: 
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- TS 24.008 [16], subclause 5.1.2.1; 

- TS 23.086 [9], subclauses 1.2, 1.3, 2.2 and 2.3; 

- TS 24.086 [10], clause 2. 

6.4.1.3 Test purpose 

1) To verify that an UE not supporting AoCC (where the Terminal does support AoCC but the USIM does not) and 
in the outgoing call / U4 call delivered state, on receipt of a CONNECT message containing AoCC information 
shall acknowledge the CONNECT message but ignore and not acknowledge the AoCC information sent within 
the CONNECT. 

2) To verify that an UE not supporting AoCC (where the Terminal does support AoCC but the USIM does not) and 
in the outgoing call / U4 call delivered state, on receipt of a FACILITY message containing AoCC information 
shall ignore and not acknowledge the AoCC information sent within the FACILITY. 

3) To verify that an UE not supporting AoCC (where the Terminal does support AoCC but the USIM does not) and 
in the incoming call / U9 call confirmed state, on receipt of a FACILITY message containing AoCC information 
shall ignore and not acknowledge the AoCC information sent within the FACILITY. 

4) To verify that an UE not supporting AoCC (where the Terminal does support AoCC but the USIM does not) and 
in the UIO call active state, on receipt of a FACILITY message containing AoCC information, shall ignore and 
not acknowledge the AoCC information sent within the FACILITY. 

6.4.1.4 Method of test 

6.4.1 .4.1 Initial conditions 

The Terminal shall be installed with a UICC or USIM simulator, with all elementary files coded as for the default 
UICC, with the exception of: 

EFusT (USIM Service Table) 

Logically: Local Phone Book available; 

User controlled PLMN selector available; 
Fixed dialling numbers available; 
The GSM Access available; 

The Group Identifier level 1 and level 2 not available; 
AoC not available. 

Service n 33 (Packed Switched Domain) shall be set to T 
Enabled Services Table available 

Coding: B1 B2 B3 B4 B5 

binary xxxxxxH xxxO xxxx xxxxIxOO xxxxxixx xxxxxxH 

The coding of EFust shall conform with the capabilities of the USIM used. 

The generic call set up procedures for UTRAN defined in TS 34.108 [21], subclause 7.2.3.2.3 and 7.2.3.1.3 and defined 
in TS 51.010-1 [22], clause 10 for GERAN are followed up to and including the reception, or transmission of the 
ALERTING message by the UE. 

6.4.1.4.2 Procedure 

a) For an MO call in the U4 state the USS/SS transmits CONNECT containing AoCC information. 

b) For an MO call in the U4 state the USS/SS transmits FACILITY containing AoCC information. 

c) For an MT call in the U9 state the USS/SS transmits FACILITY containing AoCC information. 

d) For an MO call in the UIO state the USS/SS transmits FACILITY containing AoCC information. 
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6.4.1.5 Acceptance criteria 

In all cases, the UE shall ignore the AoCC information sent to it in the Facility information elements as part of the 
CONNECT/FACILITY messages and not send any AoCC information acknowledgement. It shall be checked for 15 s 
that the UE does not transnut any AoCC information acknowledgement after the receipt of AoCC information. 

6.4.2 Maximum frequency of ACM updating 

6.4.2.1 Definition and applicability 

During a call, the ACM shall be updated at the end of every interval. The interval length is the greater of either 5 s or 
the value given by parameter e2 (part of the Facility Information Element). 

6.4.2.2 Conformance requirement 

The ACM shall be incremented when the CCM is incremented or once every 5 s, whichever is the longer period. 

When used the value IC shall be used as SFI for EFacm, for compatibility reasons the terminal shall accept other 
values. 

Reference: 

- TS 22.024 [8], subclause 4.3, part h; 

- TS 31.102 [4], subclauses 4.2.9, 5.3.4 and Annex H.l. 

6.4.2.3 Test purpose 

1) To verify that the Terminal, during a call, increments the ACM every 5 s when e2 is less or equal to 5 s. 

2) To verify that the Terminal is able to handle other values than IC as SFI of EFacm- 

6.4.2.4 Method of test 
6.4.2.4.1 Initial conditions 

The Terminal shall be connected to the USIM simulator, with all elementary files coded as default with the exception 
of: 

EFusT (USIM Service Table) 

Logically: Local Phone Book available; 

User controlled PLMN selector available; 
Fixed dialling numbers available; 
The GSM Access available; 

The Group Identifier level 1 and level 2 not available; 
AoC available. 

Service n 33 (Packed Switched Domain) shall be set to T 
Enabled Services Table available 

Coding: B1 B2 B3 B4 B5 

binary xxxxxxH xxx1 xxxx xxxxIxOO xxxxxixx xxxxxxH 

The coding of EFust shall conform with the capabilities of the USIM used. 
EFacm (Accumulated call meter) 

Logically: 50 units 

The SFI of EFacm shall be set to 18'. 
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EFACMmax (Accumulatcd call meter maximum) 

Logically: 150 units 

The USS (in case of a Terminal accessing UTRAN)/ SS (in case of a Terminal accessing a GERAN) transmits on the 
BCCH, with the following network parameters: 

- Attach/detach: disabled. 

- LAI (MCC/MNC/LAC): 246/081/0001. 

- Access control: unrestricted. 
User Equipment: 

The UE is in MM-state "idle, updated". 

In case of a Terminal accessing UTRAN "Expected Sequence A" and in case of a Terminal accessing a GERAN 
"Expected Sequence B" shall be performed. 

6.4.2.4.2 Procedure 

a) The UE is made to initiate a call. The call establishment shall be performed according to the procedures defined 
in TS 34.108 [21], subclause 7.2.3.2.3 extended by the messages of the AoCC. The call is established with 
AoCC e-parameters sent in a Facility IE in the CONNECT message, as given below. The UE returns the AoCC 
acknowledgement after the reception of the CONNECT message. It is an implementation option whether the 
AoCC acknowledge is sent by the UE before or after the CONNECT ACKNOWLEDGE. 

b) The call is maintained for 90 s, then terminated by the USS. During the call, the USIM- simulator monitors the 
time intervals between successive INCREMENT commands. As the final INCREMENT command will have 
occurred as a result of call termination, the time interval calculated since the prior INCREMENT command shall 
be ignored. 

Maximum Duration of Test: 

2 minutes. 

Expected Sequence A: 
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Step 


Direction 


Message 


Comments 


1 


UE 




The UE is made to initiate a call 


2 


UE -> USS 


RRC CONNECTION REQUEST 




3 


USS -> UE 


RRC CONNECTION SETUP 




4 


UE -> USS 


RRC CONNECTION SETUP 
COMPLETE 




5 


UE -> USS 


CM SERVICE REQUEST 




6 


USS -> UE 


AUTHENTICATION REQUEST 


MM procedure, to ensure the successful start of integrity 


7 


UE -> USS 


AUTHENTICATION RESPONSE 


in step 8 


8 


USS -> UE 


SECURITY MODE COMMAND 


RRC procedure, start of integrity is mandatory during call 


9 


UE -> USS 


SECURITY MODE COMPLETE 


setup 


10 


UE -> USS 


SETUP 




11 


USS -> UE 


CALL PROCEEDING 




12 
13 


USS -> UE 
UE -> USS 


RADIO BEARER SETUP 
RADIO BEARER 
SETUPCOMPLETE 


To a supported channel type 


14 


USS -> UE 


ALERTING 




15 


USS -> UE 


CONNECT 


As default message except contains Facility IE with 
contents as indicated in i) below 








Either A or B branch is taken 


A16 


UE -> USS 


CONNECT ACKNOWLEDGE 




A17 


UE -> USS 


FACILITY 


As default message except contains Facility IE with 
contents as indicated in ii) below 


B16 


UE -> USS 


FACILITY 


As default message except contains Facility IE with 
contents as indicated in ii) below 


B17 


UE -> USS 


CONNECT ACKNOWLEDGE 




18 






call duration 90 s after CAI information sent by USS, 


19 


USS -> UE 


DISCONNECT 




20 


UE -> USS 


RELEASE 




21 


USS -> UE 


RELEASE COMPLETE 




22 


USS -> UE 


RRC CONNECTION RELEASE 


All connections of RRC are released. 


23 


UE -> USS 


RRC CONNECTION RELEASE 
COMPLETE 





Expected Sequence B: 



Step 


Direction 


Message 


Comments 


1 


UE 




The UE is made to initiate a call 


2 


UE -> SS 


CHANNEL REQUEST 




3 


SS -> UE 


IMMEDIATE ASSIGNMENT 




4 


UE-> SS 


CM SERVICE REQUEST 




5 


SS -> UE 


CM SERVICE ACCEPT 




6 


UE -> SS 


SETUP 




7 


SS -> UE 


CALL PROCEEDING 




CD 00 


SS -> UE 
UE -> SS 


ASSIGNMENT COMMAND 
ASSIGNMENT COMPLETE 


To a supported channel type 


10 


SS -> UE 


ALERTING 




11 


SS -> UE 


CONNECT 


As default message except contains Facility IE with 
contents as indicated in i) below 








Either A or B branch is taken 


A12 


UE -> SS 


CONNECT ACKNOWLEDGE 




A13 


UE -> SS 


FACILITY 


As default message except contains Facility IE with 
contents as indicated in ii) below 


B12 


UE -> SS 


FACILITY 


As default message except contains Facility IE with 
contents as indicated in ii) below 


B13 


UE -> SS 


CONNECT ACKNOWLEDGE 




14 






call duration 90 s after CAI information sent by SS, 


15 


SS -> UE 


DISCONNECT 




16 


UE -> SS 


RELEASE 




17 


SS -> UE 


RELEASE COMPLETE 




18 


SS -> UE 


CHANNEL RELEASE 


The main signalling link is released. 
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Specific Message Contents: 

7) FACILITY Information Element with Invoke = ForwardChargelnformation component type as defined in 
TS 24.080 [17], subclause 3.6.1 table 3.3. 

For ASN.l description see default message contents in TS 51.010-1 [22], subclause 31.6.4. 

The values of the e-parameters within the parameter part of the Facility Information Element shall be set as below: 
e-parameters: 

parameter: e1 e2 e3 e4 e5 e6 E7 
value 1 1 1 

Values shown in table are in the format and have units as in TS 22.024 [8], clause 3. 

ii) FACILITY Information Element with Return Result component type as defined in TS 24.080 [17], subclause 
3.6.1 table 3.4. 

For ASN.l description see default message contents in TS 51.010-1 [22], subclause 31.6.4. 

6.4.2.5 Acceptance criteria 

The UE shall, during a call, send INCREMENT commands to the USIM every 5 s. 

6.4.3 Call terminated when ACM greater than ACMmax 

6.4.3.1 Definition and applicability 

ACMmax gives the maximum value of ACM, at which the current chargeable calls shall be terminated and no further 
calls may be made (except emergency calls). 

6.4.3.2 Conformance requirement 

ACM shall be incremented by the value of CCM. 

If the ACMmax is valid, and the ACM becomes equal to or exceeds the value of the ACMmax, then all calls in 
progress, chargeable to the user, shall be terminated by the UE, once the chargeable interval determined by the CAI has 
elapsed, (except emergency calls). 

When used the value IC shall be used as SFI for EFacm? for compatibility reasons the terminal shall accept other 
values. 

Reference: 

- TS 22.024 [8], subclauses 4.2.2 and 4.3 (part h); 

- ETSI TS 102 221 [5], subclause 14.1.3; 

- TS 31.102 [4], subclause 4.2.9, 5.3.4 and Annex H.l. 

6.4.3.3 Test purpose 

1) To verify that the Terminal increments the ACM by the correct number of units, even though this may take 
ACM above ACMmax. 

2) To verify that the Terminal terminates the call. 

3) To verify that the INCREMENT EFacm command is performed correctly by the terminal. 

4) To verify that the Terminal is able to handle other values than IC as SFI of EFacm- 
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6.4.3.4 Method of test 

6.4.3.4.1 Initial conditions 

The Terminal shall be connected to a UICC or the USIM simulator, with all elementary files coded as default with the 
exception of: 

EFusT (USIM Service Table) 

Logically: Local Phone Book available; 

User controlled PLMN selector available; 
Fixed dialling numbers available; 
The GSM Access available; 

The Group Identifier level 1 and level 2 not available; 
AoC available. 

Service n 33 (Packed Switched Domain) shall be set to T 
Enabled Services Table available 

Coding: B1 B2 B3 B4 B5 

binary xxxxxxH xxx1 xxxx xxxxIxOO xxxxxixx xxxx xx11 

The coding of EFust shall conform with the capabilities of the USIM used. 
EFacm (Accumulated call meter) 

Logically: 80 units 

Coding: B1 B2 B3 

binary 0000 0000 0000 0000 0101 0000 

The SFI of EFacm shall be set to 18'. 
EFACMmax (Accumulatcd call meter maximum) 

Logically: 94 units 

Coding: B1 B2 B3 

binary 0000 0000 0000 0000 0101 1110 

The USS transmits on the BCCH, with the following network parameters: 

- Attach/detach: disabled. 

- LAI (MCC/MNC/LAC): 246/081/0001. 

- Access control: unrestricted. 
User Equipment: 

The UE is in MM-state "idle, updated". 

In case of a Terminal accessing UTRAN "Expected Sequence A" and in case of a Terminal accessing a GERAN 
"Expected Sequence B" shall be performed. 

6.4.3.4.2 Procedure 

a) The UE is made to initiate a call. The call establishment shall be performed according to the procedures defined 
in TS 34.108 [21], subclause 7.2.3.2.3 extended by the messages of the AoCC. The call is established with 
AoCC e-parameters sent in a Facility IE in the CONNECT message, as given below. The UE returns the AoCC 
acknowledgement after the reception of the CONNECT message. It is an implementation option whether the 
AoCC acknowledge is sent by the UE before or after the CONNECT ACKNOWLEDGE. 
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b) The call is maintained until cleared by the UE (after 30 s). 

c) The contents of ACM are checked. 
Maximum Duration of Test: 

2 minutes. 
Expected Sequence A: 



Step 


Direction 


Message 


Comments 


1 


UE 




The UE is made to initiate a call 


2 


UE -> USS 


RRC CONNECTION REQUEST 




3 


USS -> UE 


RRC CONNECTION SETUP 




4 


UE -> USS 


RRC CONNECTION SETUP 
COMPLETE 




5 


USS -> UE 


AUTHENTICATION REQUEST 


MM procedure, to ensure the successful start of integrity 


6 


UE -> USS 


AUTHENTICATION RESPONSE 


in step 8 


7 


USS -> UE 


SECURITY MODE COMMAND 


RRC procedure, start of integrity is mandatory during call 


8 


UE -> USS 


SECURITY MODE COMPLETE 


setup 


9 


UE -> USS 


SETUP 




10 


USS -> UE 


CALL PROCEEDING 




11 
12 


USS -> UE 
UE-> USS 


RADIO BEARER SETUP 
RADIO BEARER SETUP 
COMPLETE 


To a supported channel type 


13 


USS -> UE 


ALERTING 




14 


USS -> UE 


CONNECT 


As default message except contains Facility IE with 
contents as indicated in i) below 








Either A or B branch is taken 


A15 


UE -> USS 


CONNECT ACKNOWLEDGE 




A16 


UE -> USS 


FACILITY 


As default message except contains Facility IE with 
contents as indicated in ii) below 


B15 


UE -> USS 


FACILITY 


As default message except contains Facility IE with 
contents as indicated in ii) below 


B16 


UE -> USS 


CONNECT ACKNOWLEDGE 




17 






call duration 30 s after CAI information sent by USS 


18 


UE-> USS 


DISCONNECT 




19 


USS -> UE 


RELEASE 




20 


UE -> USS 


RELEASE COMPLETE 




21 


USS -> UE 


RRC CONNECTION RELEASE 


All connections of RRC are released. 


22 


UE -> USS 


RRC CONNECTION RELEASE 
COMPLETE 





Expected Sequence B: 
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Step 


Direction 


Message 


Comments 


1 


UE 




The UE is made to initiate a call 


2 


UE -> SS 


CHANNEL REQUEST 




3 


SS -> UE 


IMMEDIATE ASSIGNMENT 




4 


UE -> SS 


CM SERVICE REQUEST 




5 


SS -> UE 


CM SERVICE ACCEPT 




6 


UE -> SS 


SETUP 




7 


SS -> UE 


CALL PROCEEDING 




8 


SS -> UE 


ASSIGNMENT COMMAND 




9 


UE -> SS 


to a supported channel type 
ASSIGNMENT COMPLETE 




10 


SS -> UE 


ALERTING 




11 


SS -> UE 


CONNECT 


As default message except contains Facility IE with 
contents as indicated in i) below 








Either A or B branch is taken 


A12 


UE -> SS 


CONNECT ACKNOWLEDGE 




A13 


UE-> SS 


FACILITY 


As default message except contains Facility IE with 
contents as indicated in ii) below 


B12 


UE -> SS 


FACILITY 


As default message except contains Facility IE with 
contents as indicated in ii) below 


B13 


UE -> SS 


CONNECT ACKNOWLEDGE 




14 






call duration 30 s after CAI information sent by SS 


15 


UE -> SS 


DISCONNECT 




16 


SS -> UE 


RELEASE 




17 


UE -> SS 


RELEASE COMPLETE 




18 


SS -> UE 


CHANNEL RELEASE 


The main signalling link is released. 



Specific Message Contents: 

7) FACILITY Information Element with Invoke = ForwardChargelnformation component type as defined in 
TS 24.080 [17], subclause 3.6.1 table 3.3. 

For ASN.l description see default message contents in TS 51.010-1 [22], subclause 31.6.4. 

The values of the e-parameters within the parameter part of the Facility Information Element shall be set as below: 
e-parameters: 

parameter: e1 e2 e3 e4 e5 e6 e7 
value 10 10 1 

Values shown in table are in the format and have units as in TS 22.024 [8], clause 3. 

ii) FACILITY Information Element with Return Result component type as defined in TS 24.080 [17], subclause 
3.6.1 table 3.4. 

For ASN.l description see default message contents in TS 51.010-1 [22], subclause 31.6.4. 

6.4.3.5 Acceptance criteria 

1) The UE shall terminate the call correctly 30 s after CAI was sent. 

2) The value of ACM shall be 100 units. 

6.4.4 Response codes of increase command of ACM 
6.4.4.1 Definition and applicability 

ACM has a maximum value in terms of coding, and an attempt by the Terminal to exceed that value by sending an 
INCREASE command shall result in an error message from the USIM. As the maximum of the ACM is equal to the 
maximum value of ACMmax, all current chargeable calls shall be terminated and no further calls may be made (except 
emergency calls). 
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6.4.4.2 Conformance requirement 

The Terminal shall perform the increasing procedure, sending the amount to be increased. 
The running accumulated charge shall be stored in the ACM of the USIM. 

Where this charge cannot be stored in the UE, use of the telecommunications service shall be prevented. 

At the time ACM exceeds it's maximum value, then all calls in progress, chargeable to the user, shall be terminated by 
the UE, once the chargeable interval determined by the CAI has elapsed, (except emergency calls). 

When used the value IC shall be used as SFI for EFacm? for compatibility reasons the terminal shall accept other 
values. 

References: 

- TS 31.102 [4], subclauses 4.2.9, 5.3.4 and Annex H.l; 

- TS 22.086 [18], subclauses 2.1 and 2.2.1. 

6.4.4.3 Test purpose 

1) To verify that the Terminal clears a charged call if the USIM indicates that the ACM cannot be increased. 

2) To verify that the Terminal is able to handle other values than "IC" as SFI of EFacm- 

6.4.4.4 Method of test 
6.4.4.4.1 Initial conditions 

The Terminal shall be connected to the USIM simulator, with all elementary files coded as default with the exception 
of: 

EFusT (USIM Service Table) 

Logically: Local Phone Book available; 

User controlled PLMN selector available; 
Fixed dialling numbers available; 
The GSM Access available; 

The Group Identifier level 1 and level 2 not available; 
AoC available. 

Service n 33 (Packed Switched Domain) shall be set to T 
Enabled Services Table available 

Coding: B1 B2 B3 B4 B5 

binary xxxxxxH xxx1 xxxx xxxxIxOO xxxxxixx xxxxxxH 

The coding of EFust shall conform with the capabilities of the USIM used. 
EFacm (Accumulated call meter) 

Logically: (Maximum value - 10) units 

Coding: B1 B2 B3 

binary 11111111 11111111 1111 0101 

The SFI of EFacm shall be set to "18". 
EFACMmax (Accumulated call meter maximum) 

Logically: (Maximum value - 2) units 
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Coding: 
binary 



B1 

1111 1111 



B2 

1111 1111 



B3 

1111 1101 



The USS transmits on the BCCH, with the following network parameters: 



- Attach/detach: 



disabled. 



- LAI (MCC/MNC/LAC): 246/081/0001. 



- Access control: 



unrestricted. 



User Equipment: 

The UE is in MM-state "idle, updated". 

In case of a Terminal accessing UTRAN "Expected Sequence A" and in case of a Terminal accessing a GERAN 
"Expected Sequence B" shall be performed. 



a) The UE is made to initiate a call. The call establishment shall be performed according to the procedures defined 
in TS 34.108 [21], subclause 7.2.3.2.3 extended by the messages of the AoCC. The call is established with 
AoCC e-parameters sent in a Facility IE in the CONNECT message, as given below. The UE returns the AoCC 
acknowledgement after reception of the CONNECT message. It is an implementation option whether the AoCC 
acknowledge is sent by the UE before or after the CONNECT ACKNOWLEDGE. 

b) After an interval has elapsed, the Terminal increments the ACM. When an INCREASE command is received, 
the USIM-simulator sends back the error "98 50". 

c) Conditions are reset to those described in the initial conditions. Steps a) and b) of the test are repeated, except 
that the error code sent by the USIM simulator at step b) is now "6F xx". 

d) Conditions are reset to those described in the initial conditions. Steps a) and b) of the test are repeated, except 
that the error code sent by the USIM simulator at step b) is now "65 81". 

References: 

- ETSI TS 102 221 [5], subclause 10.2.1. 
Maximum Duration of Test: 

3 minutes. 



6.4.4.4.2 



Procedure 
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Expected Sequence A: 



Step 


Direction 


Message 


Comments 


1 


UE 




The UE is made to initiate a call 


2 


UE-> USS 


RRC CONNECTION REQUEST 




3 


USS -> UE 


RRC CONNECTION SETUP 




4 


UE -> USS 


RRC CONNECTION SETUP 








COMPLETE 




5 


USS -> UE 


AUTHENTICATION REQUEST 


MM procedure, to ensure the successful start of integrity 








in step 8 


6 


UE -> USS 


AUTHENTICATION RESPONSE 




7 


USS -> UE 


SECURITY MODE COMMAND 


RRC procedure, start of integrity is mandatory during call 








setup 


8 


UE -> USS 


SECURITY MODE COMPLETE 




9 

10 


UE -> USS 


SETUP 




11 


USS -> UE 


CALL PROCEEDING 




12 


USS -> UE 


RADIO BEARER SETUP 


To a supported channel type 


13 


UE -> USS 


RADIO BEARER SETUP 






COMPLETE 




14 


USS -> UE 


ALERTING 




15 


USS -> UE 


CONNECT 


As default message except contains Facility IE with 








contents as indicated in i) below 








Either A or B branch is taken 


A16 


UE -> USS 


CONNECT ACKNOWLEDGE 




A17 


UE -> USS 


FACILITY 


As default message except contains Facility IE with 








contents as indicated in ii) below 


B16 


UE -> USS 


FACILITY 


As default message except contains Facility IE with 








contents as indicated in ii) below 


B17 


UE -> USS 


CONNECT ACKNOWLEDGE 




18 






call duration 10s after CAI information sent by USS 


19 


UE -> USS 


DISCONNECT 


20 


USS -> UE 


RELEASE 




21 


UE -> USS 


RELEASE COMPLETE 




22 


USS -> UE 


RRC CONNECTION RELEASE 


All connections of RRC are released. 


23 


UE -> USS 


RRC CONNECTION RELEASE 








COMPLETE 
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Expected Sequence B: 



Step 


Direction 


Message 


Comments 


1 


UE 




The UE is made to initiate a call 


2 


UE -> SS 


CHANNEL REQUEST 




3 


SS -> UE 


IMMEDIATE ASSIGNMENT 




4 


UE -> SS 


CM SERVICE REQUEST 




5 


SS -> UE 


CM SERVICE ACCEPT 




6 


UE -> SS 


SETUP 




7 


SS -> UE 


CALL PROCEEDING 




8 


SS -> UE 


ASSIGNMENT COMMAND 




9 


UE -> SS 


to a supported channel type 
ASSIGNMENT COMPLETE 




10 


SS -> UE 


ALERTING 




11 


SS -> UE 


CONNECT 


As default message except contains Facility IE with 
contents as indicated in i) below 








Either A or B branch is taken 


A12 


UE -> SS 


CONNECT ACKNOWLEDGE 




A13 


UE-> SS 


FACILITY 


As default message except contains Facility IE with 
contents as indicated in ii) below 


B12 


UE -> SS 


FACILITY 


As default message except contains Facility IE with 
contents as indicated in ii) below 


B13 


UE -> SS 


CONNECT ACKNOWLEDGE 




14 






call duration 10s after CAI information sent by SS 


15 


UE -> SS 


DISCONNECT 


16 


SS -> UE 


RELEASE 




17 


UE -> SS 


RELEASE COMPLETE 




18 


SS -> UE 


CHANNEL RELEASE 


The main signalling link is released. 



Specific Message Contents: 

7) FACILITY Information Element with Invoke = ForwardChargelnformation component type as defined in 
TS 24.080 [17], subclause 3.6.1 table 3.3. 

For ASN.l description see default message contents in TS 51.010-1 [22], subclause 31.6.4. 

The values of the e-parameters within the parameter part of the Facility Information Element shall be set as below: 
e-parameters: 

parameter: e1 e2 e3 e4 e5 e6 e7 
value 20 10 1 



Values shown in table are in the format and have units as in TS 22.024 [8], clause 3. 

ii) FACILITY Information Element with Return Result component type as defined in TS 24.080 [17], subclause 
3.6.1 table 3.4. 

For ASN.l description see default message contents in TS 51.010-1 [22], subclause 31.6.4. 

6.4.4.5 Acceptance criteria 

1) The UE shall terminate the call correctly 10 s after CAI was sent. 

2) In each of the three cases, as described in steps b), c) and d) of the procedure, the UE shall terminate the call 
correctly when it receives an indication from the USIM that the ACM cannot be incremented. 
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7 



PLMN related tests 



7.1 



FPLMN handling 



7.1.1 



Adding FPLMN to the Forbidden PLMN list 



7.1.1.1 



Definition and applicability 



A list of forbidden PLMNs stored in the USIM and providing storage for at least 4 entries is managed by the UE. In 
automatic PLMN selection mode the UE controls registration attempts to appropriate networks with respect to this list 
of forbidden PLMNs. As a result of a registration reject with the cause "PLMN not allowed" the UE stores the PLMN 
which rejected the update request in the USIM. 

The registration attempts initiated by the 3G UE depends on Ues capabilities and can be one of the following: 
7) registration procedures for Ues supporting CS or 

II. registration procedures for Ues supporting PS or 

III. registration procedures for Ues supporting CS/PS 



In case of a 2G terminal: 

1) In automatic PLMN selection mode the UE shall only attempt a LOCATION UPDATE if it receives a BCCH 
containing a LAI that is not indicated in the EFfplmn in the USIM. 

Reference: 

- TS 22.011 [6], subclause 2.3; 

- TS 31.102 [4], subclauses 5.1.1 and 5.2.7. 

2) After receipt of a LOCATION UPDATING REJECT message with the cause "PLMN not allowed" the Terminal 
shall update the EFfplmn in the USIM. 

Reference: 

- TS 22.011 [6], subclause 2.3; 

- TS 31.102 [4], subclauses 5.1.1 and 5.2.7. 

3) After call termination the USIM shall contain the correct Key Set Identifier. 
Reference: 

- TS 31.102 [4], subclauses 5.1.2, 5.2.5 and 5.2.6; 

- TS 21.111 [19], subclause 10.1. 

4) After call termination the USIM shall contain the correct TMSI and location information received by the UE. 
Reference: 

- TS 31.102 [4], subclauses 5.1.2, 5.2.5 and 5.2.6; 

- TS 21.111 [19], subclause 10.1. 
In case of a 3G terminal: 



7.1.1.2 



Conformance requirement 
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1) Depending on which domain the UE is going to be registered on, one of the following requirements should be 
fulfilled: 

I. In automatic PLMN selection mode the UE shall only attempt a LOCATION UPDATING REQUEST during 
registration on CS if it receives a BCCH containing a PLMN(MCC,MNC) that is not indicated in the EE 
FPLMN in the USIM or 

II. in automatic PLMN selection mode the UE shall only attempt a ATTACH REQUEST during registration on 
PS if it receives a BCCH containing a PLMN(MCC,MNC) that is not indicated in the EFfplmn in the USIM 
or 

III. in automatic PLMN selection mode the UE shall only attempt a LOCATION UPDATING REQUEST and/or 
ATTACH REQUEST during registration on CS/PS if it receives a BCCH containing a PLMN(MCC,MNC) 
that is not indicated in the EFfplmn in the USIM. 

Reference: 

- TS 22.011 [6], subclause 2.3; 

- TS 31.102 [4], subclauses 5.1.1 and 5.2.7. 

2) Depending on which domain the UE is going to be on, one of the following requirements should be fulfilled: 

I. After after receipt of a LOCATION UPDATING REJECT message during registration on CS with the cause 
"PLMN not allowed" the Terminal shall update the EFfplmn in the USIM or. 

II. after receipt of a ATTACH REJECT message during registration on PS with the cause "PLMN not allowed" 
the Terminal shall update the EFfplmn in the USIM or 

III. after receipt of a LOCATION UPDATING REJECT and/or ATTACH REJECT message during registration 
on CS/PS with the cause "PLMN not allowed" the Terminal shall update the EFfplmn in the USIM. 

Reference: 

- TS 22.011 [6], subclause 3.2.2 2.3; 

- TS 31.102 [4], subclauses 5.1.1 and 5.2.7. 

3) After call termination the USIM shall contain the correct Key Set Identifier. 

4) Depending on which domain the UE is going to be registered on, one of the following requirements should be 
fulfilled: 

I. after registration on CS the USIM shall contain the correct TMSI and location information received by the 
UE or 

II. after registration on PS the USIM shall contain the correct P-TMSI and routing information received by the 
UE or 

III. after registration on CS/PS the USIM shall contain the correct TMSI, P-TMSI, location information and 
routing information received by the UE. 

Reference: 

- TS 31.102 [4], subclauses 5.1.2, 5.2.5 and 5.2.6; 

- TS 21.111 [6], subclause 10.1. 

5) After call termination the USIM shall contain the correct TMSI and location information received by the UE. 
Reference: 

- TS 31.102 [4], subclauses 5.1.2, 5.2.5 and 5.2.6; 

- TS 21.111 [6], subclause 10.1. 
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7.1.1.3 Test purpose 

In case of a 2G terminal: 

1) To verify that in automatic PLMN selection mode the UE does not attempt to access PLMNs stored in EFfplmn 
on the USIM. 

2) To verify that the EFfplmn is correctly updated by the Terminal after receipt of a LOCATION UPDATING 
REJECT message with cause "PLMN not allowed". 

3) To verify that the EFKeys has been correctly updated by the Terminal. 

4) To verify that the EFloci has been correctly updated by the Terminal. 
In case of a 3G terminal: 

1) To verify that in automatic PLMN selection mode the UE does not attempt to access PLMNs stored in EFfplmn 
on the USIM. 

2) To verify that the EFfplmn is correctly updated by the Terminal after receipt of a 

I. LOCATION UPDATING REJECT message with cause "PLMN not allowed" during registration on CS or. 

II. ATTACH REJECT message with cause "PLMN not allowed" during registration on PS or. 

III. LOCATION UPDATING REJECT and/or ATTACH REJECT message with cause "PLMN not allowed" 
during registration on CS/PS. 

3) To verify that 

I. the EFloci has been correctly updated by the Terminal during registration on CS or. 

II. the EFpsLoci has been correctly updated by the Terminal during registration on PS or. 

III. the the EFloci and EFpsLoci have been correctly updated by the Terminal during registration on CS/PS. 

7.1.1.4 Method of test 
7.1.1.4.1 Initial conditions 

The USS (in case of a Terminal accessing UTRAN)/ SS (in case of a Terminal accessing a GERAN) transmits on the 
BCCH, with the following network parameters: 

- Attach/detach: disabled. 

- LAI (MCC/MNC/LAC): 234/002/0001. 

- RAI (MCC/MNC/LAC/RAC): 234/002/0001/05. (only for UTRAN cell) 

- Access control: unrestricted. 

NOTE: In case of a GERAN no packet system information is transmitted 
The default UICC is used with the following exception: 
EFiMsi (IMSI) 

Logically: 246081111111111 

Coding: B1 B2 B3 B4 B5 B6 B7 B8 B9 

Hex 08 29 64 80 11 11 11 11 11 

EFloci (Location Information) 

Logically: LAI-MCC: 234 
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LAI-MNC: 007 
LAI-LAC: 0000 
TMSL "32547698" 

Coding: B1 B2 B3 B4 B5 B6 B7 B8 B9 B10 B11 

Hex 32 54 76 98 32 74 00 00 00 FF 00 



EFpsLoci (Packet Switched location Information) 

Logically: RAI-MCC: 234 

RALMNC: 007 
RALLAC: 0000 
RAI-RAC: 05 
P-TMSL "32547698" 

P-TMSI signature value: " 1 12233" 



Coding: 


B1 


B2 


B3 


B4 


B5 


B6 


B7 


B8 


B9 


B10 


B11 


Hex 


32 


54 


76 


98 


11 


22 


33 


32 


74 


00 


00 




B12 


B13 


B14 




















00 


05 


00 



















The UICC is installed into the Terminal and the UE is set to automatic PLMN selection mode. 

In case of a Terminal accessing GERAN: 

EFxeys (Ciphering and Integrity Keys) 

Logically: Key Set Identifier KSI: 02 

Ciphering Keys CK: undefined 

Integrity Keys IK: undefined 

Coding: B1 B2 B3 ... B16 B17 B18 ... B31 B32 B33 

Hex 02 XX XX ... xx xx xx ... xx xx xx 



In case of a Terminal accessing UTRAN "Expected Sequence A" shall be performed and in case of a Terminal 
accessing a GERAN "Expected Sequence B" shall be performed. 

7.1.1.4.2 Procedure 

Expected Sequence A: 

a) The UE is powered on. 

b) The USS stops all RF output on the BCCH for a long enough period of time to cause a cell reselection procedure 
in the UE. The BCCH is changed to contain: 

PLMN (MCC/MNC): 234/003 

The USS then resumes RF output on the BCCH. 

7) The USS stops all RF output on the BCCH for a long enough period of time to cause a cell reselection 
procedure in the UE. The BCCH is changed to contain: 

PLMN (MCC/MNC): 234/004 

The USS then resumes RF output on the BCCH. 

7) The USS stops all RF output on the BCCH for a long enough period of time to cause a cell reselection 
procedure in the UE. The BCCH is changed to contain: 

PLMN (MCC/MNC): 234/005 
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The USS then resumes RF output on the BCCH. 

7) The USS stops all RF output on the BCCH for a long enough period of time to cause a cell reselection 
procedure in the UE. The BCCH is changed to contain: 

LAI (MCC/MNC/LAC):234/007/0001 

RAI (MCC/MNC/LAC/RAC): 234/007/0001/05 

The USS then resumes RF output on the BCCH. 

f) After receipt of a RRC CONNECTION REQUEST from the UE, the USS sends RRC CONNECTION SETUP 
to the UE, followed by RRC CONNECTION SETUP COMPLETE sent by the UE to the USS. 

g) Depending on which domain the UE is going to be registered on, one of the following sequences will be passed 
through: 

I. During registration on CS and after receipt of a LOCATION UPDATING REQUEST from the UE, the USS 
sends LOCATION UPDATING REJECT to the UE with cause "PLMN Not Allowed", followed by RRC 
CONNECTION RELEASE, followed by RRC CONNECTION RELEASE COMPLETE sent by the UE to 
the USS. 

II. During registration on PS and after receipt of a ATTACH REQUEST from the UE, the USS sends ATTACH 
REJECT to the UE with cause "PLMN Not Allowed", followed by RRC CONNECTION RELEASE, 
followed by RRC CONNECTION RELEASE COMPLETE sent by the UE to the USS or 

7) During registration on CS/PS and after receipt of a LOCATION UPDATING REQUEST and/or ATTACH 
REQUEST from the UE, the USS sends LOCATION UPDATING REJECT and/or ATTACH REJECT to 
the UE with cause "PLMN Not Allowed", followed by RRC CONNECTION RELEASE, followed by RRC 
CONNECTION RELEASE COMPLETE sent by the UE to the USS. 

The USS stops all RF output on the BCCH for a long enough period of time to cause a cell reselection procedure 
in the UE. The BCCH is changed to contain: 

LAI (MCC/MNC): 234/008/0001 

RAI (MCC/MNC/LAC/RAC): 234/008/0001/05 

The USS then resumes RF output on the BCCH. 

h) After receipt of a RRC CONNECTION REQUEST from the UE, the USS sends RRC CONNECTION SETUP 
to the UE, followed by RRC CONNECTION SETUP COMPLETE sent by the UE to the USS. 

i) Depending on which domain the UE is going to be registered on, one of the following sequences will be passed 
through: 

I. During registration on CS and after receipt of a LOCATION UPDATING REQUEST from the UE, the USS 
initiates authentication, starts integrity by using the security procedure and sends LOCATION UPDATING 
ACCEPT with: 

LAI (MCC/MNC/LAC):234/008/0001 
TMSI: "43658709" 

II. During registration on PS and after receipt of a ATTACH REQUEST from the UE, the USS initiates 
authentication, starts integrity by using the security procedure and sends ATTACH ACCEPT to the UE with : 

RAI (MCC/MNC/LAC/RAC): 234/008/0001/05 

P-TMSI: "43658709" 

P-TMSI signature value "443322" 

III. During registration on CS/PS and after receipt of a LOCATION UPDATING REQUEST and/or ATTACH 
REQUEST from the UE, the USS initiates authentication, starts integrity by using the security procedure and 
sends LOCATION UPDATING ACCEPT and/or ATTACH ACCEPT with some of the following values to 
the UE with : 
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LAI (MCC/MNC/LAC):234/008/0001 
TMSI: "43658709" 

RAI (MCC/MNC/LAC/RAC): 234/008/0001/05 
P-TMSI: "43658709" 
P-TMSI signature value "443322" 
j) After passing through the authentication procedure and after receipt of 

I. TMSI REALLOCATION COMPLETE during registration on CS from the UE the USS sends RRC 
CONNECTION RELEASE, followed by RRC CONNECTION RELEASE COMPLETE sent by the UE to 
the USS or. 

II. ATTACH COMPLETE during registration on PS from the UE, the USS sends RRC CONNECTION 
RELEASE, followed by RRC CONNECTION RELEASE COMPLETE sent by the UE to the USS or. 

III. TMSI REALLOCATION COMPLETE and/or ATTACH COMPLETE during registration on CS/PS from 
the UE, the USS sends RRC CONNECTION RELEASE, followed by RRC CONNECTION RELEASE 
COMPLETE sent by the UE to the USS. 

k) The UE is soft powered down. 

Expected Sequence B : 

a) The UE is powered on. 

b) The SS stops all RF output on the BCCH for a long enough period of time to cause a cell reselection 
procedure in the UE. The BCCH is changed to contain: 

PLMN (MCC/MNC) : 234/003 

The SS then resumes RF output on the BCCH. 

7) The SS stops all RF output on the BCCH for a long enough period of time to cause a cell reselection 
procedure in the UE. The BCCH is changed to contain: 

PLMN (MCC/MNC) : 234/004 

The SS then resumes RF output on the BCCH. 

7) The SS stops all RF output on the BCCH for a long enough period of time to cause a cell reselection 
procedure in the UE. The BCCH is changed to contain: 

PLMN (MCC/MNC): 234/005 

The SS then resumes RF output on the BCCH. 

7) The SS stops all RF output on the BCCH for a long enough period of time to cause a cell reselection 
procedure in the UE. The BCCH is changed to contain: 

PLMN (MCC/MNC): 234/007/0001 

RAI (MCC/MNC/LAC/RAC): 234/007/0001/05 

The SS then resumes RF output on the BCCH. 

f) After receipt of a CHANNEL REQUEST from the UE, the SS sends IMMEDIATE ASSIGNMENT to the 
UE. 

g) After receipt of a LOCATION UPDATING REQUEST from the UE, the SS sends LOCATION UPDATING 
REJECT to the UE with cause "PLMN Not Allowed", followed by CHANNEL RELEASE. 

The SS stops all RF output on the BCCH for a long enough period of time to cause a cell reselection 
procedure in the UE. The BCCH is changed to contain: 
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PLMN (MCC/MNC): 234/008/0001 

RAI (MCC/MNC/LAC/RAC): 234/008/0001/05 

The SS then resumes RF output on the BCCH. 

h) After receipt of a CHANNEL REQUEST from the UE, the SS sends IMMEDIATE ASSIGNMENT to the 
UE. 

i) After receipt of a LOCATION UPDATING REQUEST from the UE, the SS sends LOCATION UPDATING 
ACCEPT with: 

LAI (MCC/MNC/LAC): 234/008/0001 
TMSI: "43658709" 
to the UE. 

j) After receipt of a TMSI REALLOCATION COMPLETE from the UE, the SS sends CHANNEL RELEASE 
to the UE. 

k) The UE is soft powered down. 

7.1.1.5 Acceptance criteria 

1) After each of the steps a) to d) the UE shall not attempt a LOCATION UPDATING and not a ATTACH 
procedure. 

2) After step f) the 2G UE shall send LOCATION UPDATING REQUEST to the SS and a 3G terminal shall send 

I. LOCATION UPDATING REQUEST to the USS during registration on CS or 

II. ATTACH REQUEST during registration on PS or 

III. LOCATION UPDATING REQUEST and/or ATTACH REQUEST to the USS during registration on CS/PS. 

3) After step h) the 2G UE shall send LOCATION UPDATING REQUEST to the SS and a 3G terminal shall send 

I. LOCATION UPDATING REQUEST to the USS during registration on CS or 

II. ATTACH REQUEST during registration on PS or 

III. LOCATION UPDATING REQUEST and/or ATTACH REQUEST to the USS during registration on CS/PS. 

4) After step i) the 2G UE shall respond with TMSI REALLOCATION COMPLETE to the SS and a 3G terminal 
shall respond with 

I. TMSI REALLOCATION COMPLETE to the USS during registration on CS or 

II. ATTACH COMPLETE during registration on PS or 

III. TMSI REALLOCATION COMPLETE and/or ATTACH COMPLETE to the USS during registration on 
CS/PS.. 

7) After step k) the USIM shall contain the following values: 
EFfplmn (Forbidden PLMNs) 



Logically: PLMNl 
PLMN2 
PLMN3 
PLMN4 
PLMN5 
PLMN6 



234 002 (MCC MNC) 

234 003 

234 004 

234 005 

234 006 

234 007 
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Coding: 


B1 


B2 


B3 


B4 


B5 


B6 


B7 


B8 


B9 


B10 


B11 


B12 


Hex 


32 


24 


00 


32 


34 


00 


32 


44 


00 


32 


54 


00 




B13 


B14 


B15 


B16 


B17 


B18 
















32 


64 


00 


32 


74 


00 















For 2G terminals and 3G terminals supporting (CS and PS) or (CS only): 

EFloci (Location Information) 

Logically: LALMCC: 234 

LAI-MNC: 008 
TMSI: "43658709" 

Coding: B1 B2 B3 B4 B5 B6 B7 B8 B9 B10 B11 

Hex 43 65 87 09 32 84 00 xx xx xx 00 



For 3G terminals supporting (CS and PS) or (PS only): 

EFpsLoci (Location Information) 

Logically: RALMCC: 234 

RALMNC: 008 
P-TMSI: "43658709" 



Coding: 


B1 


B2 


B3 


B4 


B5 


B6 


B7 


B8 


B9 


B10 


B11 


Hex 


43 


65 


87 


09 


XX 


XX 


XX 


32 


84 


00 


XX 


Coding: 


B12 


B13 


B14 


















Hex 


XX 


XX 


00 



















In case of a Terminal accessing GERAN: 

EFKeys (Ciphering and Integrity Keys) 

Logically: Key Set Identifier KSI: 07 (not available) 

Ciphering Keys CK: xx 

Integrity Keys IK: xx 

Coding: B1 B2 B3 ... B16 B17 B18 ... B31 B32 B33 

Hex 07 XX XX ... xx xx xx ... xx xx Xx 



7.1 .2 UE updating forbidden PLMNs 
7.1 .2.1 Definition and applicability 

A list of forbidden PLMNs stored in the USIM provides storage for at least 4 entries, and is managed by the UE. In 
automatic PLMN selection mode the UE controls registration attempts to appropriate networks with respect to this list 
of forbidden PLMNs. As a result of a registration reject with the cause "PLMN not allowed" the UE stores the PLMN 
which rejected the update request in the USIM. 

The registration attempts initiated by the 3G UE depends on Ues capabilities and can be one of the following: 
7) registration procedures for Ues supporting CS or 

II. registration procedures for Ues supporting PS or 

III. registration procedures for Ues supporting CS/PS 
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7.1 .2.2 Conformance requirement 

In case of a 2G terminal: 

After the receipt of a LOCATION UPDATING REJECT message with the cause "PLMN not allowed" the UE shall 
update the EFfplmn in the USIM. 

Reference: 

- TS 22.01 1 [6], subclause 3.2.2.4. 

- TS 31.102 [4], subclauses 5.1.1 and 5.2.7. 

In case of a 3G terminal: 

Depending on which domain the UE will be registered on, one of the following requirements should be fulfilled: 

7) After the receipt of a LOCATION UPDATING REJECT message during registration on CS with the cause 
"PLMN not allowed" the UE shall update the EFfplmn in the USIM or 

II. after receipt of a ATTACH REJECT message during registration on PS with the cause "PLMN not allowed" the 
Terminal shall update the EE fplmn in the USIM or 

III. after receipt of a LOCATION UPDATING REJECT and/or ATTACH REJECT message during registration on 
CS/PS with the cause "PLMN not allowed" the Terminal shall update the EFfplmn in the USIM. 

Reference: 

- TS 22.01 1 [6], subclause 3.2.2.4. 

- TS 31.102 [4], subclauses 5.1.1 and 5.2.7. 

7.1.2.3 Test purpose 

To verify that the UE correctly updates the EFfplmn? i-^- fiU np existing gaps in the elementary file before overwriting 
any existing entries. 

7.1.2.4 Method of test 
7.1 .2.4.1 Initial conditions 

The USS (in case of a Terminal accessing UTRAN)/ SS (in case of a Terminal accessing a GERAN) transmits on the 
BCCH, with the following network parameters: 

- Attach/detach: disabled. 

- LAI (MCC/MNC/LAC): 234/002/0001. 

- RAI (MCC/MNC/LAC/RAC): 234/002/0001/05 (only for UTRAN cell) 

- Access control: unrestricted. 

NOTE: In case of a GERAN no packet system information is transmitted 
The default UICC is used with the following exception: 
EFfplmn (Forbidden PLMNs) 



Logically: PLMNl 
PLMN2 
PLMN3 
PLMN4 
PLMN5 
PLMN6 



234 001 (MCC MNC) 

empty 

234 003 

234 004 

234 005 

234 006 
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Coding: 


B1 


B2 


B3 


B4 


B5 


B6 


B7 


B8 


B9 


B10 


B11 


B12 


Hex 


32 


14 


00 


FF 


FF 


FF 


32 


34 


00 


32 


44 


00 




B13 


B14 


B15 


B16 


B17 


B18 
















32 


54 


00 


32 


64 


00 















The UICC is installed into the Terminal and the UE is set to automatic PLMN selection mode. 

In case of a Terminal accessing UTRAN "Expected Sequence A" and in case of a Terminal accessing a GERAN 
"Expected Sequence B" shall be performed. 

7.1.2.4.2 Procedure 

Expected Sequence A: 

a) The UE is powered on. 

b) After receipt of a RRC CONNECTION REQUEST from the UE, the USS sends RRC CONNECTION SETUP 
to the UE, followed by RRC CONNECTION SETUP COMPLETE sent by the UE to the USS. 

c) Depending on which domain the UE is going to be registered on, one of the following sequences will be passed 
through: 

I. During registration on CS and after receipt of a LOCATION UPDATING REQUEST from the UE, the USS 
sends LOCATION UPDATING REJECT to the UE with the cause "PLMN not allowed", followed by RRC 
CONNECTION RELEASE, followed by RRC CONNECTION RELEASE COMPLETE sent by the UE to 
the USS or 

II. During registration on PS and after receipt of a ATTACH REQUEST from the UE, the USS sends ATTACH 
REJECT to the UE with cause "PLMN Not Allowed", followed by RRC CONNECTION RELEASE, 
followed by RRC CONNECTION RELEASE COMPLETE sent by the UE to the USS or 

III. During registration on CS/PS and after receipt of a LOCATION UPDATING REQUEST and/or ATTACH 
REQUEST from the UE, the USS sends LOCATION UPDATING REJECT and/or ATTACH REJECT to 
the UE with cause "PLMN Not Allowed", followed by RRC CONNECTION RELEASE, followed by RRC 
CONNECTION RELEASE COMPLETE sent by the UE to the USS. 

d) The UE is soft powered down. 
Expected Sequence B: 

a) The UE is powered on. 

b) After receipt of a CHANNEL REQUEST from the UE, the SS sends IMMEDIATE ASSIGNMENT to the UE. 

c) After receipt of a LOCATION UPDATING REQUEST from the UE, the SS sends LOCATION UPDATING 
REJECT to the UE with cause "PLMN Not Allowed", followed by CHANNEL RELEASE. 

d) The UE is soft powered down. 

7.1 .2.5 Acceptance criteria 

1) After step b) the 2G UE shall send LOCATION UPDATING REQUEST to the SS and the 3G terminal shall 

send 

I. LOCATION UPDATING REQUEST to the USS during registration on CS or 

II. ATTACH REQUEST during registration on PS or 

III. LOCATION UPDATING REQUEST and/or ATTACH REQUEST to the USS during registration on CS/PS. 
7) After step d) the USIM shall contain: 

EFfplmn (Forbidden PLMNs) 
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Logically: 



PLMNl 
PLMN2 
PLMN3 
PLMN4 
PLMN5 
PLMN6 



234 001 (MCC MNC) 

234 002 

234 003 

234 004 

234 005 

234 006 



Coding: 


B1 


B2 


B3 


B4 


B5 


B6 


B7 


B8 


B9 


B10 


B11 


B12 


Hex 


32 


14 


00 


32 


24 


00 


32 


34 


00 


32 


44 


00 




B13 


B14 


B15 


B16 


B17 


B18 
















32 


54 


00 


32 


64 


00 















or 



EFfplmn (Forbidden PLMNs) 



Logically: 



PLMNl 
PLMN2 
PLMN3 
PLMN4 
PLMN5 
PLMN6 



234 001 (MCC MNC) 

234 003 

234 004 

234 005 

234 006 

234 002 



Coding: 


B1 


B2 


B3 


B4 


B5 


B6 


B7 


B8 


B9 


BIO 


B11 


B12 


Hex 


32 


14 


00 


32 


34 


00 


32 


44 


00 


32 


54 


00 




B13 


B14 


B15 


B16 


B17 


B18 
















32 


64 


00 


32 


24 


00 















7.1 .3 UE deleting forbidden PLMNs 

7.1 .3.1 Definition and applicability 

In manual PLMN selection mode the UE allows registration attempts to all available PLMNs, including forbidden 
PLMNs (as indicated by the forbidden PLMN list on the USIM). As a result of a successful registration procedure onto 
a PLMN which is in the forbidden PLMN list, the forbidden PLMN list is automatically updated by the UE. 

The registration attempts initiated by the 3G UE depends on Ues capabilities and can be one of the following: 

7) registration procedures for Ues supporting CS or 

IL registration procedures for Ues supporting PS or 

IIL registration procedures for Ues supporting CS/PS 

7.1 .3.2 Conformance requirement 

In case of a 2G terminal: 

1) In manual PLMN selection mode the UE shall be able to perform a LOCATION UPDATING attempt to a 
PLMN which is in the forbidden PLMN Hst. 

- TS 22.01 1 [6], subclause 3.2.2.2. 

2) After receipt of LOCATION UPDATING ACCEPT the UE shall delete the forbidden PLMN from the forbidden 
PLMN Hst. 

- TS 22.01 1 [6], subclause 3.2.2.4. 
In case of a 3G terminal: 
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1) Depending on which domain the UE will be registered on, one of the following requirements should be 
fulfilled: 

7) In manual PLMN selection mode the UE shall be able to perform a LOCATION UPDATING attempt 
during registration on CS to a PLMN which is in the forbidden PLMN list or 

II. In manual PLMN selection mode the UE shall be able to perform a ATTACH attempt during registration on 
PS to a PLMN which is in the forbidden PLMN Hst or 

III. In manual PLMN selection mode the UE shall be able to perform a LOCATION UPDATING and/or 
ATTACH attempt during registration on CS/PS to a PLMN which is in the forbidden PLMN Hst. 

- TS 22.01 1 [6], subclause 3.2.2.2. 

- TS 31.102 [4], subclauses 5.1.1 and 5.2.7. 

2) Depending on which domain the UE is going to be registered on, one of the following requirements should be 
fulfilled: 

7) After receipt of LOCATION UPDATING ACCEPT message during registration on CS the UE shall delete 
the forbidden PLMN from the forbidden PLMN Hst OR 

II. after receipt of ATTACH ACCEPT message during registration on PS the UE shall delete the forbidden 
PLMN from the forbidden PLMN list or 

III. after receipt of LOCATION UPDATING ACCEPT and/or ATTCH ACCEPT message during registration on 
CS/PS the UE shall delete the forbidden PLMN from the forbidden PLMN Hst. 

- TS 22.01 1 [6], subclause 3.2.2.4. 

7.1.3.3 Test purpose 

1) To verify that the 2G UE is able to perform a LOCATION UPDATING on a forbidden PLMN in manual PLMN 
selection mode or to verify that the 3G UE is able to perform 

I. a LOCATION UPDATING REQUEST during registration on CS on a forbidden PLMN in manual PLMN 

selection mode or 

II. a ATTACH REQUEST during registration on PS on a forbidden PLMN in manual PLMN selection mode or 

III. a LOCATION UPDATING REQUEST and/or ATTACH REQUEST during registration on CS/PS on a 
forbidden PLMN in manual PLMN selection mode. 

2) To verify that the UE after a successful registration attempt deletes the PLMN in the EFfplmn on the USIM. 

7.1.3.4 Method of test 
7.1 .3.4.1 Initial conditions 

The USS (in case of a Terminal accessing UTRAN)/ SS (in case of Terminal accessing a GERAN) transmits on the 
BCCH, with the following network parameters: 

- Attach/detach: disabled. 

- LAI (MCC/MNC/LAC): 234/005/0001. 

- RAI (MCC/MNC/LAC/RAC): 234/005/0001/05 (only for UTRAN cell). 

- Access control: unrestricted. 

NOTE: In case of a GERAN no packet system information is transmitted 
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The default UICC is used with the following exception: 
EFfplmn (Forbidden PLMNs) 
Logically: 



PLMNl 
PLMN2 
PLMN3 
PLMN4 
PLMN5 
PLMN6 



empty 
empty 
empty 
empty 

234 005 (MCC MNC) 
empty 



Coding: 


B1 


B2 


B3 


B4 


B5 


B6 


B7 


B8 


B9 


B10 


B11 


B12 


Hex 


FF 


FF 


FF 


FF 


FF 


FF 


FF 


FF 


FF 


FF 


FF 


FF 




B13 


B14 


B15 


B16 


B17 


B18 
















32 


54 


00 


FF 


FF 


FF 















The UICC is installed into the Terminal and the UE is set to manual PLMN selection mode. 

In case of a Terminal accessing UTRAN "Expected Sequence A" and in case of a Terminal accessing a GERAN 
"Expected Sequence B" shall be performed. 



7.1.3.4.2 Procedure 

Expected Sequence A: 

a) The UE is powered on. 

b) PLMN with MCC/MNC of 234/005 is manually selected. 

c) After receipt of a RRC CONNECTION REQUEST from the UE, the USS sends RRC CONNECTION SETUP 
to the UE, followed by RRC CONNECTION SETUP COMPLETE sent by the UE to the USS. 

d) Depending on which domain the UE is going to be registered on, one of the following sequences will be passed 
through: 

I. During registration on CS and after receipt of a LOCATION UPDATING REQUEST from the UE, the USS 
initiates authentication, starts integrity by using the security procedure and sends LOCATION UPDATING 
ACCEPT with to the UE: 



LAI (MCC/MNC/LAC): 234/005/0001 

TMSI: "12345678" 

II. During registration on PS and after receipt of a ATTACH REQUEST from the UE, the USS initiates 

authentication, starts integrity by using the security procedure and sends ATTACH ACCEPT with to the UE: 

RAI (MCC/MNC/LAC): 234/005/0001/05 

P-TMSI: "12345678" 



P-TMSI signature value "AB1234" 

III. During registration on CS/PS and after receipt of a LOCATION UPDATING REQUEST and/or ATTACH 
REQUEST from the UE, the USS initiates authentication, starts integrity by using the security procedure and 
sends LOCATION UPDATING ACCEPT and/or ATTACH ACCEPT with some of the following values to 
the UE with: 



LAI (MCC/MNC/LAC): 234/005/0001 
TMSI: "12345678" 
RAI (MCC/MNC/LAC): 234/005/0001/05 
P-TMSI: "12345678" 
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P-TMSI signature value "AB1234" 

e) After passing through the authentication procedure and after receipt of 

I. TMSI REALLOCATION COMPLETE during registration on CS from the UE, the USS sends RRC 
CONNECTION RELEASE, followed by RRC CONNECTION RELEASE COMPLETE sent by the UE to 
the USS or 

II. ATTACH COMPLETE during registration on PS from the UE, the USS sends RRC CONNECTION 
RELEASE, followed by RRC CONNECTION RELEASE COMPLETE sent by the UE to the USS or. 

III. TMSI REALLOCATION COMPLETE and/or ATTACH COMPLETE during registration on CS/PS from 
the UE, the USS sends RRC CONNECTION RELEASE, followed by RRC CONNECTION RELEASE 
COMPLETE sent by the UE to the USS. 

f) The UE is soft powered down. 
Expected Sequence B: 

a) The UE is powered on. 

b) PLMN with MCC/MNC of 234/005 is manually selected. 

c) After receipt of a CHANNEL REQUEST from the UE, the SS sends IMMEDIATE ASSIGNMENT to the UE. 

d) After receipt of a LOCATION UPDATING REQUEST from the UE, the SS sends LOCATION UPDATING 
ACCEPT with: 

LAI (MCC/MNC): 234/005 

TMSI: "12345678" 

to the UE. 

e) After receipt of TMSI REALLOCATION COMPLETE from the UE, the SS sends CHANNEL RELEASE. 

f) The UE is soft powered down. 

7. 1 .3.5 Acceptance criteria 

1) After step c) the 2G UE shall send LOCATION UPDATING REQUEST to the SS and the 3G terminal shall 
send 

I. LOCATION UPDATING REQUEST to the USS during registration on CS or 

II. ATTACH REQUEST during registration on PS or 

III. LOCATION UPDATING REQUEST and/or ATTACH REQUEST to the USS during registration on CS/PS. 

2) After step d) the 2G UE shall respond with TMSI REALLOCATION COMPLETE and the 3G terminal shall 
respond with 

I. TMSI REALLOCATION COMPLETE to the USS during registration on CS or 

II. ATTACH COMPLETE during registration on PS or 

III. TMSI REALLOCATION COMPLETE and/or ATTACH COMPLETE to the USS during registration on 
CS/PS. 
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7) After step f) the USIM shall contain the following values: 
EFfplmn (Forbidden PLMNs) 



Logically: 



PLMNl 


empty 


PLMN2 


empty 


PLMN3 


empty 


PLMN4 


empty 


PLMN5 


empty 


PLMN6 


empty 



Coding: 


B1 


B2 


B3 


B4 


B5 


B6 


B7 


B8 


B9 


B10 


B11 


B12 


Hex 


FF 


FF 


FF 


FF 


FF 


FF 


FF 


FF 


FF 


FF 


FF 


FF 




B13 


B14 


B15 


B16 


B17 


B18 
















FF 


FF 


FF 


FF 


FF 


FF 















For 2G terminals and 3G terminals supporting CS only or CS/PS : 

EFloci (Location Information) 

Logically: LAI-MCC: 234 

LAI-MNC: 005 
TMSL "12345678" 

Coding: B1 B2 B3 B4 B5 B6 B7 B8 B9 B10 B11 

Hex 12 34 56 78 32 54 00 xx xx xx 00 



For Ues supporting PS only or CS/PS : 

EFpsLoci (Location Information) 

Logically: RAI-MCC: 234 

RALMNC: 005 
P-TMSL "12345678" 



Coding: 


B1 


B2 


B3 


B4 


B5 


B6 


B7 


B8 


B9 


BIO 


B11 


Hex 


12 


34 


56 


78 


XX 


XX 


XX 


32 


54 


00 


XX 


Coding: 


B12 


B13 


B14 


















Hex 


XX 


XX 


00 



















7.1 .4 Adding FPLMN to the forbidden PLMN list when accessing E- 
UTRAN 

7.1 .4.1 Definition and applicability 

A list of forbidden PLMNs stored in the USIM and providing storage for at least 4 entries is managed by the UE. In 
automatic PLMN selection mode the UE controls registration attempts to appropriate networks with respect to this list 
of forbidden PLMNs. As a result of a registration reject with the cause "PLMN not allowed" the UE stores the PLMN 
which rejected the update request in the USIM. 

7.1 .4.2 Conformance requirement 

1) In automatic PLMN selection mode the UE shall only attempt sl AttachRe quest during registration on E- 

UTRAN/EPS if it receives a BCCH containing a PLMN (MCC,MNC) that is not indicated in the EFfplmn in the 
USIM 

Reference: 
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- TS 22.011 [6], subclause 2.3; 

- TS 31.102 [4], subclauses 5.1.1 and 5.2.7. 

2) After receipt of an AttachReject message during registration on E-UTRAN/EPS with the EMM cause "PLMN 
not allowed" the Terminal shall update the EFfplmn in the USIM. 

Reference: 

- TS 22.011 [6], subclause 3.2.2 2.3; 

- TS 31.102 [4], subclauses 5.1.1 and 5.2.7 

3) After receipt of an AttachReject message during registration on E-UTRAN/EPS with the EMM cause "PLMN 
not allowed" the Terminal shall update the EFepsloci in the USIM. 

Reference: 

- TS 24.301 [26], subclause 5.5.1.2.5; 

- TS 31.102 [4], subclauses 5.1.1 and 4.2.9.1. 

3) After registration on E-UTRAN/EPS the USIM shall contain the correct GUTI and TAI received by the UE. 
Reference: 

- TS 31.102 [4], subclauses 5.1.2 and 4.2.9.1; 

- TS 21.111 [6], subclause 10.1. 

7.1.4.3 Test purpose 

1) To verify that in automatic PLMN selection mode the UE does not attempt to access PLMNs stored in EFfplmn 
on the USIM. 

2) To verify that the EFfplmn is correctly updated by the Terminal after receipt of sl AttachReject message with 
cause "PLMN not allowed" during registration. 

3) To verify that the EFepsloci has been correctly updated by the Terminal during registration. 

7.1.4.4 Method of test 

7.1 .4.4.1 Initial conditions 

The E-USS transmits on the BCCH, with the following network parameters: 

- TAI (MCC/MNC/TAC): 234/002/0001. 

- Access control: unrestricted. 
The default E-UTRAN UICC is used. 

The UICC is installed into the Terminal and the UE is set to automatic PLMN selection mode. 

7.1 .4.4.2 Procedure 

a) The UE is powered on. 

b) The E-USS stops all RF output on the BCCH for a long enough period of time to cause a cell reselection 
procedure in the UE. The BCCH is changed to contain: 

PLMN (MCC/MNC): 234/003 
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The E-USS then resumes RF output on the BCCH. 

c) The E-USS stops all RF output on the BCCH for a long enough period of time to cause a cell reselection 

procedure in the UE. The BCCH is changed to contain: 

PLMN (MCC/MNC): 234/004 
The E-USS then resumes RF output on the BCCH. 

d) The E-USS stops all RF output on the BCCH for a long enough period of time to cause a cell reselection 
procedure in the UE. The BCCH is changed to contain: 

PLMN (MCC/MNC): 234/005 

The E-USS then resumes RF output on the BCCH. 

e) The E-USS stops all RF output on the BCCH for a long enough period of time to cause a cell reselection 

procedure in the UE. The BCCH is changed to contain: 

TAI (MCC/MNC/TAC):234/007/0001 
The E-USS then resumes RF output on the BCCH. 

f) After receipt of an RRCConnectionRequest from the UE, the E-USS sends RRCConnectionSetup to the UE, 
followed by RRCConnectionSetupComplete sent by the UE to the E-USS. 

g) During registration and after receipt of an AttachRequest from the UE, the E-USS sends AttachReject to the UE 
with cause "PLMN Not Allowed", followed by RRCConnectionRelease. 

h) The E-USS stops all RF output on the BCCH for a long enough period of time to cause a cell reselection 

procedure in the UE. The BCCH is changed to contain: 

TAI (MCC/MNC/T AC) : 234/008/000 1 

The E-USS then resumes RF output on the BCCH. 

h) After receipt of an RRCConnectionRequest from the UE, the USS sends RRCConnectionSetup to the UE, 
followed by RRCConnectionSetupComplete sent by the UE to the USS. 

i) During registration and after receipt of dixv AttachRequest from the UE, the E-USS initiates authentication, starts 
integrity by using the security procedure and sends AttachAccept to the UE with: 

TAI (MCC/MNC/TAC):234/008/ 0001 

GUTI: "23400800010266436587" 
j) After receipt of AttachComplete during registration from the UE, the E-USS sends RRCConnectionRelease. 
k) The UE is soft powered down. 

7. 1 .4.5 Acceptance criteria 

1) After each of the steps a) to d) the terminal shall not attempt an Attach procedure. 

2) After step f) the terminal shall send AttachRequest during registration. 

3) After step h) the terminal shall send AttachRequest during registration. 

4) After step i) the terminal shall respond with AttachComplete during registration. 

5) After step k) the USIM shall contain the following values: 
EFfplmn (Forbidden PLMNs) 

Logically: PLMNl : 234 002 (MCC MNC) 

PLMN2: 234 003 
PLMN3: 234 004 
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PLMN4: 234 005 
PLMN5: 234 006 
PLMN6: 234 007 



Coding: 


B1 


B2 


B3 


B4 


B5 


B6 


B7 


B8 


B9 


B10 


B11 


B12 


Hex 


32 


24 


00 


32 


34 


00 


32 


44 


00 


32 


54 


00 




B13 


B14 


B15 


B16 


B17 


B18 
















32 


64 


00 


32 


74 


00 















EFepsloci (EPS Information) 

Logically: GUTI: 23400800010266436587 

Last visited registered TAL 234/008/0001 
EPS update status: updated 



Coding: 


B1 


B2 


B3 


B4 


B5 


B6 


B7 


B8 


B9 


BIO 


B11 


Hex 


OB 


F6 


32 


84 


00 


00 


01 


02 


66 


43 


65 


























B12 


B13 


B14 


B15 


B16 


B17 


B18 










87 


32 


84 


00 


00 


01 


00 











7.1 .5 UE updating forbidden PLMNs when accessing E-UTRAN 

7.1 .5.1 Definition and applicability 

A list of forbidden PLMNs stored in the USIM provides storage for at least 4 entries, and is managed by the UE. In 
automatic PLMN selection mode the UE controls registration attempts to appropriate networks with respect to this list 
of forbidden PLMNs. As a result of a registration reject with the cause "PLMN not allowed" the UE stores the PLMN 
which rejected the update request in the USIM. 

7.1 .5.2 Conformance requirement 

After receipt of a AttachReject message during registration with the cause "PLMN not allowed" the Terminal shall 
update the EE fplmn in the USIM. 

Reference: 

- TS 22.011 [6], subclause 3.2.2.4. 

- TS 31.102 [4], subclauses 5.1.1 and 5.2.7. 

7.1.5.3 Test purpose 

To verify that the UE correctly updates the EEfplmn. i-^- fill up existing gaps in the elementary file before overwriting 
any existing entries. 

7.1.5.4 Method of test 
7.1 .5.4.1 Initial conditions 

The E-USS transmits on the BCCH, with the following network parameters: 

- T AI (MCC/MNC/T AC) : 234/002/000 1 . 

- Access control: unrestricted. 
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The default E-UTRAN UICC is used with the following exception: 
EFfplmn (Forbidden PLMNs) 



Logically: 



PLMNl 
PLMN2 
PLMNS 
PLMN4 
PLMN5 
PLMN6 



234 001 (MCC MNC) 

empty 

234 003 

234 004 

234 005 

234 006 



Coding: 


B1 


B2 


B3 


B4 


B5 


B6 


B7 


B8 


B9 


B10 


B11 


B12 


Hex 


32 


14 


00 


FF 


FF 


FF 


32 


34 


00 


32 


44 


00 




B13 


B14 


B15 


B16 


B17 


B18 
















32 


54 


00 


32 


64 


00 















The UICC is installed into the Terminal and the UE is set to automatic PLMN selection mode. 



7.1.5.4.2 Procedure 

a) The UE is powered on. 

b) After receipt of a RRCConnectionRequest from the UE, the E-USS sends RRCConnectionSetup to the UE, 
followed by RRCConnectionSetupComplete sent by the UE to the E-USS. 

c) During registration and after receipt of a AttachRequest from the UE, the E-USS sends AttachReject to the UE 
with cause "PLMN Not Allowed", followed by RRCConnectionRelease. 

d) The UE is soft powered down. 

7. 1 .5.5 Acceptance criteria 

1) After step b) the terminal shall send AttachRequest during registration. 

2) After step d) the USIM shall contain: 
EFfplmn (Forbidden PLMNs) 



Logically: 



PLMNl 
PLMN2 
PLMN3 
PLMN4 
PLMNS 
PLMN6 



234 001 (MCC MNC) 

234 002 

234 003 

234 004 

234 005 

234 006 



Coding: 


B1 


B2 


B3 


B4 


B5 


B6 


B7 


B8 


B9 


B10 


B11 


B12 


Hex 


32 


14 


00 


32 


24 


00 


32 


34 


00 


32 


44 


00 




B13 


B14 


B15 


B16 


B17 


B18 
















32 


54 


00 


32 


64 


00 















or 
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EFfplmn (Forbidden PLMNs) 

Logically: PLMNl 
PLMN2 
PLMN3 
PLMN4 
PLMNS 
PLMN6 



234 001 (MCC MNC) 

234 003 

234 004 

234 005 

234 006 

234 002 



Coding: 


B1 


B2 


B3 


B4 


B5 


B6 


B7 


B8 


B9 


B10 


B11 


B12 


Hex 


32 


14 


00 


32 


34 


00 


32 


44 


00 


32 


54 


00 




B13 


B14 


B15 


B16 


B17 


B18 
















32 


64 


00 


32 


24 


00 















7.1 .6 UE deleting forbidden PLMNs when accessing E-UTRAN 

7.1 .6.1 Definition and applicability 

In manual PLMN selection mode the UE allows registration attempts to all available PLMNs, including forbidden 
PLMNs (as indicated by the forbidden PLMN list on the USIM). As a result of a successful registration procedure onto 
a PLMN which is in the forbidden PLMN list, the forbidden PLMN list is automatically updated by the UE. 

7.1 .6.2 Conformance requirement 

a) In manual PLMN selection mode the UE shall be able to perform a ATTACH attempt during registration to a 
PLMN which is in the forbidden PLMN list or 

- TS 22.01 1 [6], subclause 3.2.2.2. 

- TS 31.102 [4], subclauses 5.1.1 and 5.2.7. 

b) After receipt of AttachAccept message during registration the UE shall delete the forbidden PLMN from the 
forbidden PLMN list or 

- TS 22.01 1 [6], subclause 3.2.2.4. 

7.1.6.3 Test purpose 

1) To verify that the terminal is able to perform mi AttachRe quest during registration on a forbidden PLMN in 
manual PLMN selection mode. 

2) To verify that the UE after a successful registration attempt deletes the PLMN in the EFfplmn on the USIM. 

7.1.6.4 Method of test 
7.1 .6.4.1 Initial conditions 

The E-USS transmits on the BCCH, with the following network parameters: 

- LAI (MCC/MNC/LAC): 234/005/0001. 

- Access control: unrestricted. 
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The default E-UTRAN UICC is used with the following exception: 
EFfplmn (Forbidden PLMNs) 



Logically: 



PLMNl 
PLMN2 
PLMN3 
PLMN4 
PLMN5 
PLMN6 



empty 
empty 
empty 
empty 

234 005 (MCC MNC) 
empty 



Coding: 


B1 


B2 


B3 


B4 


B5 


B6 


B7 


B8 


B9 


B10 


B11 


B12 


Hex 


FF 


FF 


FF 


FF 


FF 


FF 


FF 


FF 


FF 


FF 


FF 


FF 




B13 


B14 


B15 


B16 


B17 


B18 
















32 


54 


00 


FF 


FF 


FF 















The UICC is installed into the Terminal and the UE is set to manual PLMN selection mode. 

7.1.6.4.2 Procedure 

a) The UE is powered on. 

b) PLMN with MCC/MNC of 234/005 is manually selected. 

c) After receipt of a RRCConnectRequest from the UE, the E-USS sends RRCConnectionSetup to the UE, followed 
by RRCConnectionSetupComplete sent by the UE to the E-USS. 

d) During registration and after receipt of a AttachRequest from the UE, the E-USS initiates authentication, starts 
integrity by using the security procedure and sends AttachAccept with to the UE: 

TAI (MCC/MNC/TAC):234/005/ 0001 

GUTL "23400500010266436587" 

e) After receipt of the AttachComplete during registration from the UE, the E-USS sends RRCConnectionRelease. 

f) The UE is soft powered down. 

7.1.6.5 Acceptance criteria 

1) After step c) the terminal shall send AttachRequest during registration 

2) After step d) the terminal shall respond with AttachComplete during registration 

3) After step f) the USIM shall contain the following values: 
EFfplmn (Forbidden PLMNs) 



Logically: 



PLMNl 
PLMN2 
PLMN3 
PLMN4 
PLMN5 
PLMN6 



empty 
empty 
empty 
empty 
empty 
empty 



Coding: 


B1 


B2 


B3 


B4 


B5 


B6 


B7 


B8 


B9 


B10 


B11 


B12 


Hex 


FF 


FF 


FF 


FF 


FF 


FF 


FF 


FF 


FF 


FF 


FF 


FF 




B13 


B14 


B15 


B16 


B17 


B18 
















FF 


FF 


FF 


FF 


FF 


FF 
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EFepsloci (EPS Information) 

Logically: GUTI: 23400500010266436587 

Last visited registered TAL 234/005/0001 
EPS update status: updated 



Coding: 


B1 


B2 


B3 


B4 


B5 


B6 


B7 


B8 


B9 


BIO 


B11 


Hex 


OB 


F6 


32 


54 


00 


00 


01 


02 


66 


43 


65 


























B12 


B13 


B14 


B15 


B16 


B17 


B18 










87 


32 


54 


00 


00 


01 


00 











7.2 User controlled PLMN selector handling 
7.2.1 UE updating the User controlled PLMN selector list 

7.2.1 .1 Definition and applicability 

The User controlled PLMN selector list gives in priority order the preferred UPLMNs on which the UE shall register. 
The Radio Access Technology identifier defines the Radio network in which the UE shall register. The list is stored on 
the USIM in the EFplmnwact- Update and deletion of PLMNs may be performed by the subscriber. 

7.2.1 .2 Conformance requirement 

The UE shall correctly replace the selected UPLMN in the User controlled PLMN selector list. 
- TS 31.102 [4], subclause 5.3.6. 

7.2.1.3 Test purpose 

To verify that the UE correctly updates the EFplmnwact- 

7.2.1.4 Method of test 

7.2.1 .4.1 Initial conditions 

No USS/SS is required for this test. 
The default UICC is used. 

The UICC is installed into the Terminal and the UE is powered on. 

7.2.1.4.2 Procedure 

a) The user shall initiate an MMI dependent procedure to change the second UPLMN in the User controlled PLMN 
selector list to MCC/MNC of 567/02, the ACT identifier shall set to UTRAN only. 

b) The UE is soft powered down. 

7.2.1 .5 Acceptance criteria 

After step b) the USIM shall contain the following values: 
EFpLMNwACT (UPLMN Selector) 

Logically: 1 PLMN: 244 08 1 (MCC MNC) 
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V ACT: 


UTRAN 


2"^ PLMN: 


567 02 


2"^ ACT 


UTRAN 


3'^ PLMN: 


244 082 


3'^ ACT 


UTRAN 


4* PLMN: 


244 082 


4* ACT 


GSM 


5'^ PLMN: 


244 003 


5'^ ACT 


UTRAN 


6'^ PLMN: 


244 004 


6'^ ACT 


UTRAN 


7'^ PLMN: 


244 005 


7* ACT 


UTRAN 


8'^ PLMN: 


244 006 


8* ACT 


UTRAN 


9* PLMN: 


244 007 


9'^ ACT 


UTRAN 


10* PLMN: 


244 008 


10'^ ACT 


UTRAN 


11* PLMN: 


244 009 


11* ACT 


UTRAN 


12* PLMN: 


244 010 


12* ACT 


UTRAN 



Coding: 
Hex 



B1 


B2 


B3 


B4 


B5 


B6 


B7 


B8 


B9 


BIO 


B11 


B12 


B13 


B14 


B15 


42 


14 


80 


80 


00 


65 


F7 


20 


80 


00 


42 


24 


80 


80 


00 


B16 


B17 


B18 


B19 


B20 


B21 


B22 


B23 


B24 


B25 


B26 


B27 


B28 


B29 


B30 


42 


24 


80 


00 


80 


42 


34 


00 


80 


00 


42 


44 


00 


80 


00 


B31 


B32 


B33 


B34 


B35 


B36 


B37 


B38 


B39 


B40 


B41 


B42 


B43 


B44 


B45 


42 


54 


00 


80 


00 


42 


64 


00 


80 


00 


42 


74 


00 


80 


00 


B46 


B47 


B48 


B49 


B50 


B51 


B52 


B53 


B54 


B55 


B56 


B57 


B58 


B59 


B60 


42 


84 


00 


80 


00 


42 


94 


00 


80 


00 


42 


04 


10 


80 


00 



7.2.2 UE recognising the priority order of the User controlled PLMN 
selector list with the same access technology. 



7.2.2.1 Definition and applicability 

The User controlled PLMN selector list gives in priority order the preferred UPLMNs on which the UE shall register. 
The Radio Access Technology identifier defines the Radio network in which the UE shall register. The list is stored on 
the USIM in the EFplmnwact- Update and deletion of UPLMNs may be performed by the subscriber by the use of the 
PIN. 

The registration attempts initiated by the terminal accessing UTRAN depends on terminal's capabilities and can be one 
of the following: 

7) registration procedures for Ues supporting CS or 

II. registration procedures for Ues supporting PS or 

III. registration procedures for Ues supporting CS/PS 



7.2.2.2 Conformance requirement 

When registering onto a VPLMN the UE shall take into account the priority order of the UPLMNs in the preferred list 
on the USIM. 



- TS 22.011 [6], subclause 3.2.2. 
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7.2.2.3 Test purpose 

To verify that the UPLMN with the higher priority (defined by its position in EFplmnwact) takes precedence over the 
UPLMN with the lower priority when the UE performs a network selection. 

7.2.2.4 Method of test 
7.2.2.4.1 Initial conditions 

The USS (in case of a Terminal accessing UTRAN)/ SS (in case of a Terminal accessing a GERAN) transmits on two 
BCCHs, with the following network parameters: 

- Attach/detach: disabled. 

- LAI (MCC/MNC/LAC): 244/033/0001. 

- RAI (MCC/MNC/LAC/RAC): 244/033/0001/05 (only for UTRAN cell). 

- Access control: unrestricted. 

- Attach/detach: disabled. 

- LAI (MCC/MNC/LAC): 244/034/0001. 

- RAI (MCC/MNC/LAC/RAC): 244/034/0001/05 (only for UTRAN cell). 

- Access control: unrestricted. 

NOTE: In case of a GERAN no packet system information is transmitted 
The default UICC is used with the following exception: 
EFpLMNwACT (UPLMN Selector with Access Technology) 



Logically: 



V PLMN: 


244 081 (MCC MNC) 


V ACT: 


UTRAN 


2"^ PLMN: 


244 081 


2^^ ACT 


GSM 


3'^ PLMN: 


244 082 


3'^ ACT 


UTRAN 


3'^ PLMN: 


244 082 


3'^ ACT 


GSM 


8* PLMN: 


244 034 


8'^ ACT 


GSM 


9* PLMN: 


244 033 


9* ACT 


GSM 


10'^ PLMN: 


244 008 


10* ACT 


UTRAN 


11'^ PLMN: 


244 034 


11'^ ACT 


UTRAN 


12* PLMN: 


244 033 


12* ACT 


UTRAN 
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Coding: 
Hex 



B1 


82 


B3 


B4 


B5 


B6 


B7 


B8 


B9 


BIO 


B11 


B12 


B13 


B14 


B15 


42 


14 


80 


80 


00 


42 


14 


80 


00 


80 


42 


24 


80 


80 


00 


B16 


B17 


B18 


B19 


B20 






















42 


24 


80 


00 


80 
































B36 


B37 


B38 


B39 


B40 


B41 


B42 


B43 


B44 


B45 












42 


44 


30 


00 


80 


42 


34 


30 


00 


80 


B46 


B47 


B48 


B49 


B50 


B51 


B52 


B53 


B54 


B55 


B56 


B57 


B58 


B59 


B60 


42 


84 


00 


80 


00 


42 


44 


30 


80 


00 


42 


34 


30 


80 


00 



The UICC is installed into the Terminal and the UE is set to automatic PLMN selection mode. 

In case of a Terminal accessing UTRAN "Expected Sequence A" and in case of a Terminal accessing a GERAN 
"Expected Sequence B" shall be performed. 

7.2.2.4.2 Procedure 

Expected Sequence A: 

a) The UE is powered on. 

b) After receipt on the cell related to the BCCH transmitting MCC/MNC 244/034 of a RRC CONNECTION 
REQUEST from the UE, the USS sends RRC CONNECTION SETUP to the UE, followed by RRC 
CONNECTION SETUP COMPLETE sent by the UE to the USS. 

c) Depending on which domain the UE is going to be registered on, one of the following sequences will be passed 
through: 

I. During registration on CS and after receipt of a LOCATION UPDATING REQUEST from the UE, the USS 
initiates authentication, starts integrity by using the security procedure and sends LOCATION UPDATING 
ACCEPT to the UE with the following values: 

LAI (MCC/MNC/LAC): 244/034/0001 

TMSI: "34567890" 

II. During registration on PS and after receipt of a ATTACH REQUEST from the UE, the USS initiates 
authentication, starts integrity by using the security procedure and sends ATTACH ACCEPT to the UE with 
the following values : 

RAI (MCC/MNC/LAC/RAC) 244/034/0001/05 

P-TMSI "34567890" 

P-TMSI signature value "AB1234" 

III. During registration on CS/PS and after receipt of a LOCATION UPDATING REQUEST and/or ATTACH 
REQUEST from the UE, the USS initiates authentication, starts integrity by using the security procedure and 
sends LOCATION UPDATING ACCEPT and/or ATTACH ACCEPT to the UE with some of the following 
values : 

LAI (MCC/MNC/LAC): 244/034/0001 
TMSI: "34567890" 

RAI (MCC/MNC/LAC/RAC) 244/034/0001/05 

P-TMSI "34567890" 

P-TMSI signature value " AB 1234" 
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d) After passing through the authentication procedure and after receipt of 

I. TMSI REALLOCATION COMPLETE during registration on CS from the UE, the USS sends RRC 
CONNECTION RELEASE to the UE, followed by RRC CONNECTION RELEASE COMPLETE sent by 
the UE to the USS or 

II. ATTACH COMPLETE during registration on PS from the UE, the USS sends RRC CONNECTION 
RELEASE, followed by RRC CONNECTION RELEASE COMPLETE sent by the UE to the USS or. 

III. TMSI REALLOCATION COMPLETE and/or ATTACH COMPLETE during registration on CS/PS from 
the UE, the USS sends RRC CONNECTION RELEASE, followed by RRC CONNECTION RELEASE 
COMPLETE sent by the UE to the USS. 

e) The UE is soft powered down. 
Expected Sequence B: 

a) The UE is powered on. 

b) After receipt of a CHANNEL REQUEST from the UE, the SS sends IMMEDIATE ASSIGNMENT to the UE. 

c) After receipt of a LOCATION UPDATING REQUEST from the UE, the SS sends LOCATION UPDATING 
ACCEPT with: 

LAI (MCC/MNC): 244/034 

TMSI: "34567890" 

to the UE 

d) After receipt of a TMSI REALLOCATION COMPLETE from the UE, the SS sends CHANNEL RELEASE to 
the UE. 

e) The UE is soft powered down. 

7.2.2.5 Acceptance criteria 

1) After step a) the UE accessing a GERAN shall send CHANNEL REQUEST on the cell related to the BCCH 
transmitting MCC/MNC 244/034 to the SS and the UE accessing UTRAN shall send an RRC CONNECTION 
REQUEST on the cell related to the BCCH transmitting MCC/MNC 244/034 to the USS. 

2) After step b) the UE accessing a GERAN shall send LOCATION UPDATING REQUEST to the SS and the UE 
accessing UTRAN shall send 

I. LOCATION UPDATING REQUEST to the USS during registration on CS or 

II. ATTACH REQUEST to the USS during registration on PS or 

III. LOCATION UPDATING REQUEST and/or ATTACH REQUEST to the USS during registration on CS/PS. 

3) After step c) the UE accessing a GERAN shall respond with TMSI REALLOCATION COMPLETE and the UE 
accessing UTRAN shall respond with 

I. TMSI REALLOCATION COMPLETE to the USS during registration on CS or 

II. ATTACH COMPLETE during registration on PS or 

III. TMSI REALLOCATION COMPLETE and/or ATTACH COMPLETE to the USS during registration on 
CS/PS. 

7) After step e) the USIM shall contain the following values: 
For Ues accessing GERAN and Ues accessing UTRAN and supporting (CS and PS) or (CS only): 
EFloci (Location Information) 

Logically: LAI-MCC: 244 
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LAI-MNC: 034 
TMSI: "34567890" 

Coding: Bl B2 B3 B4 B5 B6 B7 B8 B9 BIO Bll 
Hex 34 56 78 90 42 44 30 xx xx xx 00 

For Ues accessing UTRAN and supporting (CS and PS) or (PS only): 

EFpsLoci (Location Information) 

Logically: RALMCC: 244 

RALMNC: 034 
P-TMSI: "34567890" 



Coding: 


B1 


B2 


B3 


B4 


B5 


B6 


B7 


B8 


B9 


B10 


B11 


Hex 


34 


56 


78 


90 


XX 


XX 


XX 


42 


44 


30 


XX 


Coding: 


B12 


B13 


B14 


















Hex 


XX 


xx 


00 



















7.2.3 UE recognising the priority order of the User controlled PLMN 
selector list using an ACT preference. 

7.2.3.1 Definition and applicability 

The User controlled PLMN selector list gives in priority order the preferred PLMNs of the User on which the UE shall 
register. The Radio Access Technology identifier defines the Radio network in which the UE shall register. The list is 
stored on the USIM in the EFplmnwact- Update and deletion of User controlled PLMNs may be performed by the 
subscriber by the use of the PIN. 

7.2.3.2 Conformance requirement 

When registering onto a VPLMN the UE shall take into account the priority of the ACT identifier in the preferred list 
on the USIM. 

- TS 22.01 1 [6], subclause 3.2.2; 

- TS 31.102 [4], subclauses 4.2.5 and 5.1.2. 

7.2.3.3 Test purpose 

To verify that the ACT with the higher priority (defined by its position in EFplmnwact) takes precedence over the 
UPLMN with the lower priority when the UE performs a network selection. 

7.2.3.4 Method of test 
7.2.3.4.1 Initial conditions 

For this test both a GSM SS and an UTRAN USS is needed. 

The GSM SS transmits on BCCH, with the following network parameters: 

- Attach/detach: disabled. 

- LAI (MCC/MNC/LAC): 244/081/0001. 

- Access control: unrestricted. 

The UMTS USS transmits on BCCH, with the following network parameters: 
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- Attach/detach: disabled. 

- LAI (MCC/MNC/LAC): 244/082/0001. 

- Access control: unrestricted. 
The default UICC is used. 

The UICC is installed into the Terminal and the UE is set to automatic PLMN selection mode. 

7.2.3.4.2 Procedure 

a) The UE is powered on. 

b) After receipt of a CHANNEL REQUEST from the UE on the GSM-cell related to the BCCH transmitting 
MCC/MNC 244/081, the SS sends IMMEDIATE ASSIGNMENT to the UE. 

c) After receipt of a LOCATION UPDATING REQUEST from the UE, the SS sends LOCATION UPDATING 
ACCEPT with: 

LAI (MCC/MNC): 244/08 1 

TMSI: "34567890" 

to the UE. 

d) After receipt of a TMSI REALLOCATION COMPLETE from the UE, the SS sends CHANNEL RELEASE to 
the UE. 

e) The UE is soft powered down. 

7.2.3.5 Acceptance criteria 

1.) After step a) the UE shall send a CHANNEL REQUEST on the GSM-cell related to the BCCH transmitting 
MCC/MNC 244/081 to the SS. 

2) After step b) the UE shall send LOCATION UPDATING REQUEST to the SS. 

3) After step c) the UE shall respond with TMSI REALLOCATION COMPLETE. 

4) After step e) the USIM shall contain the following values: 

EFloci (Location Information) 

Logically: LAI-MCC: 244 

LAI-MNC: 081 
TMSI: "34567890" 

Coding: B1 B2 B3 B4 B5 B6 B7 B8 B9 B10 B11 

Hex 34 56 78 90 42 14 80 xx xx xx 00 



7.2.4 Void 

7.2.5 UE updating the User controlled PLMN selector list for E-UTRAN 
7.2.5.1 Definition and applicability 

The User controlled PLMN selector list gives in priority order the preferred UPLMNs on which the UE shall register. 
The Radio Access Technology identifier defines the Radio network in which the UE shall register. The list is stored on 
the USIM in the EFplmnwact- Update and deletion of PLMNs may be performed by the subscriber. 
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7.2.5.2 Conformance requirement 

The UE shall correctly replace the selected UPLMN in the User controlled PLMN selector list. 
- TS 31.102 [4], subclause 5.3.6 and 4.2.5. 

7.2.5.3 Test purpose 

To verify that the UE correctly updates the EFplmnwact- 

7.2.5.4 Method of test 

7.2.5.4.1 Initial conditions 

No USS/SS is required for this test. 
The default E-UTRAN UICC is used. 

The UICC is installed into the Terminal and the UE is powered on. 

7.2.5.4.2 Procedure 

a) The user shall initiate an MMI dependent procedure to change the second UPLMN in the User controlled PLMN 
selector Hst to MCC/MNC of 567/04, the ACT identifier shall set to E-UTRAN only. 

b) The UE is soft powered down. 

7.2.5.5 Acceptance criteria 

After step b) the USIM shall contain the following values: 
EFpLMNwACT (UPLMN Selector) 



V PLMN: 


244 081 (MCC MNC) 


V ACT: 


E-UTRAN 


2^^ PLMN: 


567 04 


2"^ ACT 


E-UTRAN 


3'^ PLMN: 


244 083 


3'^ ACT: 


E-UTRAN 


4* PLMN: 


244 082 


4* ACT: 


GSM 


5'^ PLMN: 


244 003 


5* ACT: 


E-UTRAN 


6'^ PLMN: 


244 004 


6'^ ACT: 


UTRAN 


7'^ PLMN: 


244 005 


1'^ ACT: 


UTRAN 


8* PLMN: 


244 081 


8'^ ACT: 


UTRAN 


9'^ PLMN: 


244 007 


9* ACT: 


UTRAN 


10'^ PLMN: 


244 008 


10'^ ACT: 


E-UTRAN 


11* PLMN: 


244 009 


11* ACT: 


UTRAN 


12* PLMN: 


244 010 


12* ACT: 


E-UTRAN 
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Coding: 
Hex 



B1 


B2 


B3 


B4 


B5 


B6 


B7 


B8 


B9 


BIO 


B11 


B12 


B13 


B14 


B15 


42 


14 


80 


40 


00 


65 


F7 


40 


40 


00 


42 


34 


80 


40 


00 


B16 


B17 


B18 


B19 


B20 


B21 


B22 


B23 


B24 


B25 


B26 


B27 


B28 


B29 


B30 


42 


24 


80 


00 


80 


42 


34 


00 


40 


00 


42 


44 


00 


80 


00 


B31 


B32 


B33 


B34 


B35 


B36 


B37 


B38 


B39 


B40 


B41 


B42 


B43 


B44 


B45 


42 


54 


00 


80 


00 


42 


14 


80 


80 


00 


42 


74 


00 


80 


00 


B46 


B47 


B48 


B49 


B50 


B51 


B52 


B53 


B54 


B55 


B56 


B57 


B58 


B59 


B60 


42 


84 


00 


40 


00 


42 


94 


00 


80 


00 


42 


04 


10 


40 


00 



7.2.6 UE recognising the priority order of the User controlled PLMN 
selector list using an ACT preference- UTRAN/E-UTRAN 

7.2.6.1 Definition and applicability 

The User controlled PLMN selector list gives in priority order the preferred PLMNs of the User on which the UE shall 
register. The Radio Access Technology identifier defines the Radio network in which the UE shall register. The list is 
stored on the USIM in the EFplmnwact- Update and deletion of User controlled PLMNs may be performed by the 
subscriber by the use of the PIN. 

7.2.6.2 Conformance requirement 

When registering onto a VPLMN the UE shall take into account the priority of the ACT identifier in the preferred list 
on the USIM. 

- TS 22.011 [6], subclause 3.2.2; 

- TS 31.102 [4], subclauses 4.2.5 and 5.1.1.2. 



7.2.6.3 Test purpose 

To verify that the ACT with the higher priority (defined by its position in EFplmnwact) takes precedence over the 
UPLMN with the lower priority when the UE performs a network selection. Hereby the new coding for RAT 
E-UTRAN has to be handled correctly by the UE. 



7.2.6.4 Method of test 



7.2.6.4.1 Initial conditions 

For this test both a UTRAN USS and an E-UTRAN E-USS is needed. 
The USS transmits on BCCH, with the following network parameters: 
- Attach/detach: disabled. 



- LAI (MCC/MNC/LAC): 244/004/0001. 

- Access control: unrestricted. 

The E-USS transmits on the BCCH, with the following network parameters: 

- TAI (MCC/MNC/TAC): 244/003/0001. 

- Access control: unrestricted. 
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The default E-UTRAN UICC is used. 

The UICC is installed into the Terminal and the UE is set to automatic PLMN selection mode. 

7.2.6.4.2 Procedure 

a) The UE is powered on. 

b) After receipt of an RRCConnectionRe quest from the UE on the E-UTRAN-cell related to the BCCH transmitting 
MCC/MNC 244/003, the E-USS sends RRCConnectionSetup to the UE, followed by 
RRCConnectionSetupComplete sent by the UE to the E-USS. 

c) During registration and after receipt of 2l AttachRequest from the UE, the E-USS initiates authentication, starts 
integrity by using the security procedure and sends AttachAccept with to the UE: 

TAI (MCC/MNC/TAC):244/003/ 0001 

GUTI: "24400300010266436587" 

d) After receipt of the AttachComplete during registration from the UE, the E-USS sends RRCConnectionRelease. 

e) The UE is soft powered down. 

7.2.6.5 Acceptance criteria 

1.) After step a) the UE shall send a RRCConnectionRequest on the E-UTRAN-cell related to the BCCH 
transmitting MCC/MNC 244/003 to the E-USS. 

2) After step b) the terminal shall send AttachRequest to the E-USS. 

3) After step c) the terminal shall respond with AttachComplete during registration. 

4) After step e) the USIM shall contain the following values: 
EFepsloci (EPS Information) 

Logically: GUTI: 24400300010266436587 

Last visited registered TAL 244/003/0001 
EPS update status: updated 



Coding: 


B1 


B2 


B3 


B4 


B5 


B6 


B7 


B8 


B9 


B10 


B11 


Hex 


OB 


F6 


42 


34 


00 


00 


01 


02 


66 


43 


65 


























B12 


B13 


B14 


B15 


B16 


B17 


B18 










87 


42 


34 


00 


00 


01 


00 











7.2.7 UE recognising the priority order of the User controlled PLMN 
selector list using an ACT preference- GSM/E-UTRAN 

7.2.7.1 Definition and applicability 

The User controlled PLMN selector list gives in priority order the preferred PLMNs of the User on which the UE shall 
register. The Radio Access Technology identifier defines the Radio network in which the UE shall register. The list is 
stored on the USIM in the EFplmnwact- Update and deletion of User controlled PLMNs may be performed by the 
subscriber by the use of the PIN. 
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7.2.7.2 Conformance requirement 

When registering onto a VPLMN the UE shall take into account the priority of the ACT identifier in the preferred list 
on the USIM. 

- TS 22.01 1 [6], subclause 3.2.2; 

- TS 31.102 [4], subclauses 4.2.5 and 5.1.1.2. 

7.2.7.3 Test purpose 

To verify that the ACT with the higher priority (defined by its position in EFplmnwact) takes precedence over the 
UPLMN with the lower priority when the UE performs a network selection. Hereby the new coding for RAT 
E-UTRAN has to be handled correctly by the UE. 

7.2.7.4 Method of test 

7.2.7.4.1 Initial conditions 

For this test both a GSM SS and an E-UTRAN E-USS is needed. 

The GSM SS transmits on BCCH, with the following network parameters: 

- Attach/detach: disabled. 

- LAI (MCC/MNC/LAC): 244/082/0001. 

- Access control: unrestricted. 

The E-USS transmits on the BCCH, with the following network parameters: 

- TAI (MCC/MNC/TAC): 244/083/0001. 

- Access control: unrestricted. 
The default E-UTRAN UICC is used. 

The UICC is installed into the Terminal and the UE is set to automatic PLMN selection mode. 

7.2.7.4.2 Procedure 

a) The UE is powered on. 

b) After receipt of an RRCConnectionRequest from the UE on the E-UTRAN-cell related to the BCCH transmitting 
MCC/MNC 244/083, the E-USS sends RRCConnectionSetup to the UE, followed by 
RRCConnectionSetupComplete sent by the UE to the E-USS. 

c) During registration and after receipt of a AttachRequest from the UE, the E-USS initiates authentication, starts 
integrity by using the security procedure and sends AttachAccept with to the UE: 

TAI (MCC/MNC/TAC):244/083/ 0001 

GUTI: "24408300010266436587" 

d) After receipt of the AttachComplete during registration from the UE, the E-USS sends RRCConnectionRelease. 

e) The UE is soft powered down. 

7.2.7.5 Acceptance criteria 

1.) After step a) the UE shall send a RRCConnectionRequest on the E-UTRAN-cell related to the BCCH 
transmitting MCC/MNC 244/083 to the e-USS. 

2) After step b) the terminal shall send AttachRequest to the E-USS. 
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3) After step c) the terminal shall respond with AttachComplete during registration. 

4) After step e) the USIM shall contain the following values: 
EFepsloci (EPS Information) 

Logically: GUTI: 24408300010266436587 

Last visited registered TAL 244/083/0001 
EPS update status: updated 



Coding: 


B1 


B2 


B3 


B4 


B5 


B6 


B7 


B8 


B9 


BIO 


B11 


Hex 


OB 


F6 


42 


34 


80 


00 


01 


02 


66 


43 


65 


























B12 


B13 


B14 


B15 


B16 


B17 


B18 










87 


42 


34 


80 


00 


01 


00 











7.3 Operator controlled PLMN selector handling 

7.3.1 UE recognising the priority order of the Operator controlled PLMN 
selector list. 

7.3.1 .1 Definition and applicability 

The Operator controlled PLMN selector list gives in priority order the preferred OPLMNs on which the UE shall 
register if no network of the User controlled PLMN selector list is available. The Radio Access Technology identifier 
defines the Radio network in which the UE shall register. The list is stored on the USIM in the EFoplmnwact- Update 
and deletion of OPLMNs shall not be possible by the subscriber by the use of the PIN. 

The registration attempts initiated by the UE accessing UTRAN depends on UE's capabilities and can be one of the 
following: 

7) registration procedures for Ues supporting CS or 

II. registration procedures for Ues supporting PS or 

III. registration procedures for Ues supporting CS/PS 

7.3.1 .2 Conformance requirement 

When registering onto a VPLMN the UE shall take into account the priority of OPLMNs in the preferred list on the 
USIM. 

- TS 22.01 1 [6], subclause 3.2.2; 

- TS 31.102 [4], subclause 4.2.53. 

7.3.1.3 Test purpose 

To verify that the OPLMN with the higher priority (defined by its position in EFoplmnwact) takes precedence over the 
OPLMN with the lower priority when the UE performs a network selection. 

7.3.1.4 Method of test 
7.3.1 .4.1 Initial conditions 

For this test a USS (in case of a Terminal accessing UTRAN) or a SS (in case of a Terminal accessing a GERAN) is 
needed. 
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The USS (in case of a Terminal accessing UTRAN)/ SS (in case of a Terminal accessing a GERAN)transmits on two 
BCCHs, with the following network parameters: 

- Attach/detach: disabled. 

- LAI (MCC/MNC/LAC): 254/01 1/0001 . 

- RAI (MCC/MNC/LAC/RAC): 254/01 1/0001/05 (for UTRAN cell only). 

- Access control: unrestricted. 

- Attach/detach: disabled. 

- LAI (MCC/MNC/LAC): 254/012/0001. 

- RAI (MCC/MNC/LAC/RAC): 254/012/0001/05 (for UTRAN cell only). 

- Access control: unrestricted. 

NOTE: In case of a GERAN no packet system information is transmitted. 

The default UICC is used with the following exceptions: 

EFusT (USIM Service Table) 

Logically: Local Phone Book available 

User controlled PLMN selector available 
Fixed dialling numbers available 
Barred dialling numbers available 
The GSM Access available 

The Group Identifier level 1 and level 2 not available 
Service n 33 (Packed Switched Domain) shall be set to T 
Enabled Services Table available 
Operator controlled PLMN selector available 

Coding: B1 B2 B3 B4 B5 B6 

binary xx1 x xx1 1 xxxx xxxx xxxx 1 xOO xxxx x1 xx xxxx xx1 1 xxxx xx1 x 



The coding of EFust shall conform with the capabilities of the USIM used. 
EFoPLMNwACT (OPLMN Selector) 



Logically: 



V PLMN: 


254 012 (MCC MNC) 


V ACT 


UTRAN 


2"^ PLMN: 


254 011 


2"^ ACT 


UTRAN 


3'^ PLMN: 


254 002 


3'^ ACT: 


UTRAN 


4* PLMN: 


254 012 


4* ACT: 


GSM 


5'^ PLMN: 


254 011 


5* ACT: 


GSM 


6'^ PLMN: 


254 005 


6'^ ACT: 


UTRAN 


7'^ PLMN: 


254 006 


7'^ ACT: 


UTRAN 


8'^ PLMN: 


254 007 


8'^ ACT: 


UTRAN 



ETSI 



3GPP TS 31.121 version 10.2.1 Release 10 



173 



ETSI TS 131 121 VI 0.2.1 (2011-11) 



B01 


B02 


BOS 


B04 


B05 


B06 


B07 


B08 


B09 


BIO 


52 


24 


10 


80 


00 


52 


14 


10 


80 


00 


B11 


B12 


B13 


B14 


B15 


B16 


B17 


B18 


B19 


B20 


52 


24 


00 


80 


00 


52 


24 


10 


00 


80 


B21 


B22 


B23 


B24 


B25 


B26 


B27 


B28 


B29 


B30 


52 


14 


10 


00 


80 


52 


54 


00 


80 


00 


83 1 


B32 


B33 


B34 


B35 


B36 


B37 


B38 


B39 


B40 


52 


64 


00 


80 


00 


52 


74 


00 


80 


00 



The UICC is installed into the Terminal and the UE is set to automatic PLMN selection mode. 

In case of a Terminal accessing UTRAN "Expected Sequence A" and in case of a Terminal accessing a GERAN 
"Expected Sequence B" shall be performed. 

7.3.1.4.2 Procedure 

Expected Sequence A: 

a) The UE is powered on. 

b) After receipt on the cell related to the BCCH transmitting MCC/MNC 254/012 of a RRC CONNECTION 
REQUEST from the UE, the USS sends RRC CONNECTION SETUP to the UE, followed by RRC 
CONNECTION SETUP COMPLETE sent by the UE to the USS. 

c) Depending on which domain the UE is going to be registered on, one of the following requirements should be 
fulfilled: 

I. During registration on CS and after receipt of a LOCATION UPDATING REQUEST from the UE, the USS 
initiates authentication, starts integrity by using the security procedure and sends LOCATION UPDATING 
ACCEPT to the UE with the following values: 

LAI (MCC/MNC/LAC): 254/012/0001 

TMSI: "34567890" 

II. During registration on PS and after receipt of a ATTACH REQUEST from the UE, the USS initiates 
authentication, starts integrity by using the security procedure and sends ATTACH ACCEPT to the UE.with 
following values : 

RAI (MCC/MNC/LAC/RAC) 254/012/0001/05 

P-TMSI "34567890" 

P-TMSI signature value "AB1234" 

III. During registration on CS/PS and after receipt of a LOCATION UPDATING REQUEST and/or ATTACH 
REQUEST from the UE, the USS initiates authentication, starts integrity by using the security procedure and 
sends LOCATION UPDATING ACCEPT and/or ATTACH ACCEPT to the UE.with some of the following 
values : 

LAI (MCC/MNC): 254/012/0001 
TMSI: "34567890" 
RAI (MCC/MNC/LAC/RAC) 254/012/0001/05 
P-TMSI "34567890" 
P-TMSI signature value "AB1234" 
d) After receipt of a 

I. TMSI REALLOCATION COMPLETE during registration on CS from the UE, the USS sends RRC 

CONNECTION RELEASE to the UE, followed by RRC CONNECTION RELEASE COMPLETE sent by 
the UE to the USS. 
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II. ATTACH COMPLETE during registration on PS from the UE, the USS sends RRC CONNECTION 
RELEASE, followed by RRC CONNECTION RELEASE COMPLETE sent by the UE to the USS or. 

III. TMSI REALLOCATION COMPLETE and/or ATTACH COMPLETE during registration on CS/PS from 
the UE, the USS sends RRC CONNECTION RELEASE, followed by RRC CONNECTION RELEASE 
COMPLETE sent by the UE to the USS. 

e) The UE is soft powered down. 

Expected Sequence B: 

a) The UE is powered on. 

b) After receipt of a CHANNEL REQUEST from the UE, the SS sends IMMEDIATE ASSIGNMENT to the UE. 

c) After receipt of a LOCATION UPDATING REQUEST from the UE, the SS sends LOCATION UPDATING 
ACCEPT with: 

LAI (MCC/MNC): 254/012 

TMSI: "34567890" 

to the UE. 

d) After receipt of a TMSI REALLOCATION COMPLETE from the UE, the SS sends CHANNEL RELEASE to 
the UE. 

e) The UE is soft powered down. 

7.3.1 .5 Acceptance criteria 

1) After step a) the UE accessing a GERAN shall send CHANNEL REQUEST on the cell related to the BCCH 

transmitting MCC/MNC 254/012 to the SS and the UE accessing UTRAN shall send an RRC CONNECTION 
REQUEST on the cell related to the BCCH transmitting MCC/MNC 254/012 to the USS. 

2) After step b) the UE accessing a GERAN shall send LOCATION UPDATING REQUEST to the SS and the UE 
accessing UTRAN shall send 

I. LOCATION UPDATING REQUEST to the USS during registration on CS or 

II. ATTACH REQUEST. To the USS during registration on PS or 

III. LOCATION UPDATING REQUEST and/or ATTACH REQUEST to the USS during registration on CS/PS. 

3) After step c) the UE accessing GERAN shall respond with TMSI REALLOCATION COMPLETE and the UE 
accessing UTRAN shall respond with 

I. TMSI REALLOCATION COMPLETE during registration on CS or 

II. ATTACH COMPLETE during registration on PS or 

III. TMSI REALLOCATION COMPLETE and/or ATTACH COMPLETE to the USS during registration on 
CS/PS. 
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7) After step e) the USIM shall contain the following values: 

For Ues accessing GERAN and Ues accessing UTRAN and supporting (CS and PS) or (CS only): 

EFloci (Location Information) 

Logically: LALMCC: 254 

LAI-MNC: 012 
TMSI: "34567890" 



Coding: 
Hex 



B1 
34 



B2 
56 



B3 
78 



84 
90 



B5 
52 



B6 
24 



87 
10 



B8 

XX 



B9 

XX 



B10 

XX 



B11 
00 



For Ues supporting (CS and PS) or (PS only): 

EFpsLoci (Location Information) 

Logically: RALMCC: 254 

RALMNC: 012 
P-TMSI: "34567890" 



Coding: 


B1 


B2 


B3 


B4 


B5 


B6 


B7 


B8 


B9 


B10 


B11 


Hex 


34 


56 


78 


90 


XX 


XX 


XX 


52 


24 


10 


XX 


Coding: 


B12 


B13 


B14 


















Hex 


XX 


XX 


00 



















7.3.2 UE recognising the priority order of the User controlled PLMN 
selector over the Operator controlled PLMN selector list. 

7.3.2.1 Definition and applicability 

The User controlled PLMN selector list has a higher priority as the OPLMN selector list on which the UE shall 
register. The Radio Access Technology identifier defines the Radio network in which the UE shall register. The list is 
stored on the USIM in the EFplmnwact- 

The registration attempts initiated by the terminal accessing UTRAN depends on terminal's capabilities and can be one 
of the following: 

7) registration procedures for Ues supporting CS or 

II. registration procedures for Ues supporting PS or 

III. registration procedures for Ues supporting CS/PS 

7.3.2.2 Conformance requirement 

When registering onto a VPLMN the UE shall take into account the priority of UPLMNs first before the OPLMNs in 
the preferred list on the USIM. 

- TS 22.01 1 [6], subclause 3.2.2.2; 

- TS 31.102 [4], subclauses 4.2.5 and 4.2.53. 

7.3.2.3 Test purpose 

To verify that the User controlled PLMN with a lower priority (defined by its position in EFplmnwact) takes precedence 
over the OPLMN with a higher priority when the UE performs a network selection. 
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7.3.2.4 Method of test 



7.3.2.4.1 Initial conditions 

For this test a USS (in case of a Terminal accessing UTRAN) or a SS (in case of a Terminal accessing a GERAN)is 
needed. 

The USS (in case of a Terminal accessing UTRAN)/ SS (in case of a Terminal accessing a GERAN)transmits on two 
BCCHs, with the following network parameters: 

- Attach/detach: disabled. 



- LAI (MCC/MNC/LAC): 254/001/0001. 

- RAI (MCC/MNC/LAC/RAC): 254/001/0001/05 (only for UTRAN cell).- Access control: unrestricted. 

- Attach/detach: disabled. 



- LAI (MCC/MNC/LAC): 244/010/0001. 

- RAI (MCC/MNC/LAC/RAC): 244/010/0001/05 (only for UTRAN cell).. 

- Access control: unrestricted. 



NOTE: In case of a GERAN no packet system information is transmitted 

The default UICC is used with the following exception: 

EFusT (USIM Service Table) 

Logically: Local Phone Book available 

User controlled PLMN selector available 
Fixed dialling numbers available 
Barred dialling numbers available 
The GSM Access available 

The Group Identifier level 1 and level 2 not available 
Service n 33 (Packed Switched Domain) shall be set to T 
Enabled Services Table available 
Operator controlled PLMN selector available 

Coding: B1 B2 B3 B4 B5 B6 

binary xx1 x xx1 1 xxxx xxxx xxxx 1 xOO xxxx x1 xx xxxx xx1 1 xxxx xx1 x 



The coding of EFust shall conform with the capabilities of the USIM used. 
EFpLMNwACT (UPLMN Selector with Access Technology) 



Logically: 



V PLMN: 


244 081 (MCC MNC) 


V ACT: 


UTRAN 


2"^ PLMN: 


244 081 


2"^ ACT: 


GSM 


3'^ PLMN: 


244 082 


3'^ ACT: 


UTRAN 


4* PLMN: 


244 082 


4* ACT: 


GSM 


5'^ PLMN: 


244 003 


5* ACT: 


UTRAN 


6'^ PLMN: 


244 004 


6'^ ACT: 


UTRAN 


7* PLMN: 


244 005 


7* ACT: 


UTRAN 


8'^ PLMN: 


244 006 


8* ACT: 


UTRAN 


9'^ PLMN: 


244 007 
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9* ACT: 


UTRAN 




PLMN: 


244 008 


10* 


ACT: 


UTRAN 


11* 


PLMN: 


244 010 


11* 


ACT: 


UTRAN 


12* 


PLMN: 


244 010 


12* 


ACT: 


GSM 



Coding: 
Hex 



B1 


B2 


B3 


B4 


B5 


B6 


B7 


B8 


B9 


BIO 


B11 


B12 


B13 


B14 


B15 


42 


14 


80 


80 


00 


42 


14 


80 


00 


80 


42 


24 


80 


80 


00 


B16 


B17 


B18 


B19 


B20 


B21 


B22 


B23 


B24 


B25 


B26 


B27 


B28 


B29 


B30 


42 


24 


80 


00 


80 


42 


24 


00 


80 


00 


42 


44 


00 


80 


00 


B31 


B32 


B33 


B34 


B35 


B36 


B37 


B38 


B39 


B40 


B41 


B42 


B43 


B44 


B45 


42 


54 


00 


80 


00 


42 


64 


00 


80 


00 


42 


74 


00 


80 


00 


B46 


B47 


B48 


B49 


B50 


B51 


B52 


B53 


B54 


B55 


B56 


B57 


B58 


B59 


B60 


42 


84 


00 


80 


00 


42 


04 


10 


80 


00 


42 


04 


10 


00 


80 



The UICC is installed into the Terminal and the UE is set to automatic PLMN selection mode. 

In case of a Terminal accessing UTRAN "Expected Sequence A" and in case of a Terminal accessing a GERAN 
"Expected Sequence B" shall be performed. 

7.3.2.4.2 Procedure 

Expected Sequence A: 

a) The UE is powered on. 

b) After receipt of a RRC CONNECTION REQUEST from the UE on the cell related to the BCCH transmitting 
MCC/MNC 244/010, the USS sends RRC CONNECTION SETUP to the UE, followed by RRC CONNECTION 
SETUP COMPLETE sent by the UE to the USS. 

c) Depending on which domain the UE is going to be registered on , one of the following requirements should be 
fulfilled: 

I. During registration on CS and after receipt of a LOCATION UPDATING REQUEST from the UE, the USS 
initiates authentication, starts integrity by using the security procedure and sends LOCATION UPDATING 
ACCEPT to the UE with the following values: 

LAI (MCC/MNC/LAC): 244/010/0001 

TMSI: "34567890" 

II. During registration on PS and after receipt of a ATTACH REQUEST from the UE, the USS initiates 
authentication, starts integrity by using the security procedure and sends ATTACH ACCEPT with the 
following values : 

RAI (MCC/MNC/LAC/RAC) 244/010/0001/05 

P-TMSI "34567890" 

P-TMSI signature value "AB1234" 

III. During registration on CS/PS and after receipt of a LOCATION UPDATING REQUEST and/or ATTACH 
REQUEST from the UE, the USS initiates authentication, starts integrity by using the security procedure and 
sends LOCATION UPDATING ACCEPT and/or ATTACH ACCEPT with some of the following values : 

LAI (MCC/MNC/LAC): 244/010/0001 

TMSI: "34567890" 

RAI (MCC/MNC/LAC/RAC) 244/010/0001/05 
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P-TMSI "34567890" 
P-TMSI signature value " AB 1234" 
d) After receipt of a 

I. TMSI REALLOCATION COMPLETE during registration on CS from the UE, the USS sends RRC 
CONNECTION RELEASE to the UE, followed by RRC CONNECTION RELEASE COMPLETE sent by 
the UE to the USS. 

II. ATTACH COMPLETE during registration on PS from the UE, the USS sends RRC CONNECTION 
RELEASE, followed by RRC CONNECTION RELEASE COMPLETE sent by the UE to the USS or. 

III. TMSI REALLOCATION COMPLETE and/or ATTACH COMPLETE during registration on CS/PS from 
the UE, the USS sends RRC CONNECTION RELEASE, followed by RRC CONNECTION RELEASE 
COMPLETE sent by the UE to the USS. 

e) The UE is soft powered down. 

Expected Sequence B: 

a) The UE is powered on. 

b) After receipt of a CHANNEL REQUEST from the UE, the SS sends IMMEDIATE ASSIGNMENT to the UE. 

c) After receipt of a LOCATION UPDATING REQUEST from the UE, the SS sends LOCATION UPDATING 
ACCEPT with: 

LAI (MCC/MNC): 244/010 

TMSI: "34567890" 

to the UE. 

d) After receipt of a TMSI REALLOCATION COMPLETE from the UE, the SS sends CHANNEL RELEASE to 
the UE. 

e) The UE is soft powered down. 

7.3.2.5 Acceptance criteria 

1) After step a) the UE accessing a GERAN shall send CHANNEL REQUEST on the cell related to the BCCH 
transmitting MCC/MNC 244/010 to the SS and the UE accessing UTRAN shall send an RRC CONNECTION 
REQUEST on the cell related to the BCCH transmitting MCC/MNC 244/010 to the USS. 

2) After step b) the UE accessing a GERAN shall send LOCATION UPDATING REQUEST to the SS and the UE 
accessing UTRAN shell send 

I. LOCATION UPDATING REQUEST to the USS during registration on CS or 

II. ATTACH REQUEST during registration on PS or 

III. LOCATION UPDATING REQUEST and/or ATTACH REQUEST to the USS during registration on CS/PS. 

3) After step c) the UE accessing GERAN shall respond with TMSI REALLOCATION COMPLETE and the UE 
accessing UTRAN shall respond with 

I. TMSI REALLOCATION COMPLETE during registration on CS or 

II. ATTACH COMPLETE during registration on PS or 

III. TMSI REALLOCATION COMPLETE and/or ATTACH COMPLETE to the USS during registration on 
CS/PS.. 

7) After step e) the USIM shall contain the following values: 
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For Ues accessing GERAN and Ues accessing UTRAN and supporting (CS and PS) or (CS only): 

EFloci (Location Information) 

Logically: LAI-MCC: 244 

LALMNC: 010 
TMSI: "34567890" 

Coding: B1 B2 B3 84 B5 B6 B7 B8 B9 B10 B11 

34 56 78 90 42 04 10 xx xx xx 00 



For Ues supporting (CS and PS) or (PS only): 

EFpsLoci (Location Information) 

Logically: RALMCC: 244 

RALMNC: 010 
P-TMSI: "34567890" 



Coding: 


B1 


B2 


B3 


B4 


B5 


B6 


B7 


B8 


B9 


B10 


B11 


Hex 


34 


56 


78 


90 


XX 


XX 


XX 


42 


04 


10 


XX 


Coding: 


B12 


B13 


B14 


















Hex 


XX 


XX 


00 



















7.3.3 UE recognising the priority order of the Operator controlled PLMN 
selector list when accessing E-UTRAN 

7.3.3.1 Definition and applicability 

The Operator controlled PLMN selector list gives in priority order the preferred OPLMNs on which the UE shall 
register if no network of the User controlled PLMN selector list is available. The Radio Access Technology identifier 
defines the Radio network in which the UE shall register. The list is stored on the USIM in the EFoplmnwact- Update 
and deletion of OPLMNs shall not be possible by the subscriber by the use of the PIN. 

7.3.3.2 Conformance requirement 

When registering onto a VPLMN the UE shall take into account the priority of OPLMNs in the preferred list on the 
USIM. 

- TS 22.01 1 [6], subclause 3.2.2; 

- TS 31.102 [4], subclause 4.2.53, 4.2.5 and 5.1.1.2. 



7.3.3.3 Test purpose 

To verify that the OPLMN with the higher priority (defined by its position in EFoplmnwact) takes precedence over the 
OPLMN with the lower priority when the UE performs a network selection. Hereby the new coding for RAT 
E-UTRAN has to be handled correctly by the UE. 



7.3.3.4 Method of test 
7.3.3.4.1 Initial conditions 

For this test an E-USS is required. 

The E-USS transmits on two BCCHs, with the following network parameters: 
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- TAI (MCC/MNC/TAC): 254/012/0001. 

- Access control: unrestricted. 

The default E-UTRAN UICC is used with the following exceptions: 

EFusT (USIM Service Table) 

Logically: Local Phone Book available 

User controlled PLMN selector available 
Fixed dialling numbers available 
Barred dialling numbers available 
The GSM Access available 

The Group Identifier level 1 and level 2 not available 

Service n 33 (Packed Switched Domain) shall be set to T 

Enabled Services Table available 

Operator controlled PLMN selector available 

EPS Mobility Management Information available 

Allowed CSG Lists and corresponding indications not available 



Coding: B1 B2 B3 B4 B5 B6 B7 B8 

Binary xx1 x xx1 1 xxxx xxxx xxxx 1 xOO xxxx x1 xx xxxx xx1 1 xxxx xx1 x xxxx xxxx xxxx xxxx 

B9 B10 B11 

xxxx xxxx xxxx xxxx xx01 xxxx 



The coding of EFust shall conform with the capabilities of the USIM used. 
EFoPLMNwACT (OPLMN Selector) 



V PLMN: 


254 012 (MCC MNC) 


V ACT 


E-UTRAN 


2^^ PLMN: 


254 011 


2nd j^^j 


E-UTRAN 


3'^ PLMN: 


254 002 


3'^ ACT: 


E-UTRAN 


4'^ PLMN: 


254 012 


4'^ ACT: 


GSM 


5* PLMN: 


254 011 


5'^ ACT: 


GSM 


6'^ PLMN: 


254 005 


6* ACT: 


UTRAN 


7'^ PLMN: 


254 006 


1'^ ACT: 


UTRAN 


8* PLMN: 


254 007 


8* ACT: 


UTRAN 



Coding: 


B01 


B02 


BOS 


B04 


B05 


B06 


B07 


B08 


B09 


BIO 


Hex 


52 


24 


10 


40 


00 


52 


14 


10 


40 


00 




B11 


B12 


B13 


B14 


B15 


B16 


B17 


BIB 


B19 


B20 




52 


24 


00 


40 


00 


52 


24 


10 


00 


80 




B21 


B22 


B23 


B24 


B25 


B26 


B27 


B28 


B29 


B30 




52 


14 


10 


00 


80 


52 


54 


00 


80 


00 




B31 


B32 


B33 


B34 


B35 


B36 


B37 


B38 


B39 


B40 




52 


64 


00 


80 


00 


52 


74 


00 


80 


00 



The UICC is installed into the Terminal and the UE is set to automatic PLMN selection mode. 
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7.3.3.4.2 Procedure 

a) The UE is powered on. 

b) After receipt of an RRCConnectionRequest from the UE on the E-UTRAN-cell related to the BCCH transmitting 
MCC/MNC 254/012, the E-USS sends RRCConnectionSetup to the UE, followed by 
RRCConnectionSetupComplete sent by the UE to the E-USS. 

c) During registration and after receipt of sl AttachRequest from the UE, the E-USS initiates authentication, starts 
integrity by using the security procedure and sends AttachAccept with to the UE: 

TAI (MCC/MNC/TAC):254/012/ 0001 

GUTI: "25401200010266436587" 

d) After receipt of the AttachComplete during registration from the UE, the E-USS sends RRCConnectionRelease. 

e) The UE is soft powered down. 

7.3.3.5 Acceptance criteria 

1.) After step a) the UE shall send a RRCConnectionRequest on the E-UTRAN-cell related to the BCCH 
transmitting MCC/MNC 254/012 to the e-USS. 

2) After step b) the terminal shall send AttachRequest to the E-USS. 

3) After step c) the terminal shall respond with AttachComplete during registration. 

4) After step e) the USIM shall contain the following values: 
EFepsloci (EPS Information) 

Logically: GUTI: 25401200010266436587 

Last visited registered TAL 254/012/0001 
EPS update status: updated 



Coding: 


B1 


B2 


B3 


B4 


B5 


B6 


B7 


B8 


B9 


BIO 


B11 


Hex 


OB 


F6 


52 


24 


10 


00 


01 


02 


66 


43 


65 


























B12 


B13 


B14 


B15 


B16 


B17 


B18 










87 


52 


24 


10 


00 


01 


00 











7.3.4 UE recognising the priority order of the User controlled PLMN 

selector over the Operator controlled PLMN selector list - E-UTRAN 

7.3.4.1 Definition and applicability 

The User controlled PLMN selector list has a higher priority as the OPLMN selector list on which the UE shall 
register. The Radio Access Technology identifier defines the Radio network in which the UE shall register. The list is 
stored on the USIM in the EFplmnwact- 

7.3.4.2 Conformance requirement 

When registering onto a VPLMN the UE shall take into account the priority of UPLMNs first before the OPLMNs in 
the preferred list on the USIM. 

- TS 22.01 1 [6], subclause 3.2.2.2; 

- TS 31.102 [4], subclauses 4.2.5, 4.2.53 and 5.1.1.2. 
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7.3.4.3 Test purpose 

To verify that the User controlled PLMN with a lower priority (defined by its position in EFplmnwact) takes precedence 
over the OPLMN with a higher priority when the UE performs a network selection. Hereby the new coding for RAT 
E-UTRAN has to be handled correctly by the UE. 

7.3.4.4 Method of test 
7.3.4.4.1 Initial conditions 

For this test an E-USS is required. 

The E-USS transmits on two BCCHs, with the following network parameters: 
- TAI (MCC/MNC/TAC): 254/001/0001. 
~ Access control: unrestricted. 



- TAI (MCC/MNC/TAC): 244/010/0001. 

- Access control: unrestricted. 

The default E-UTRAN UICC is used with the following exception: 

EFusT (USIM Service Table) 

Logically: Local Phone Book available 

User controlled PLMN selector available 
Fixed dialling numbers available 
Barred dialling numbers available 
The GSM Access available 

The Group Identifier level 1 and level 2 not available 

Service n 33 (Packed Switched Domain) shall be set to T 

Enabled Services Table available 

Operator controlled PLMN selector available 

EPS Mobility Management Information available 

Allowed CSG Lists and corresponding indications not available 

Coding: B1 B2 B3 B4 B5 B6 B7 B8 

Binary xx1 x xx1 1 xxxx xxxx xxxx 1 xOO xxxx x1 xx xxxx xx1 1 xxxx xx1 x xxxx xxxx xxxx xxxx 

B9 B10 B11 

xxxx xxxx xxxx xxxx xx01 xxxx 



The UICC is installed into the Terminal and the UE is set to automatic PLMN selection mode. 



7.3.4.4.2 Procedure 

a) The UE is powered on. 

b) After receipt of an RRCConnectionRe quest from the UE on the E-UTRAN-cell related to the BCCH transmitting 
MCC/MNC 244/010, the E-USS sends RRCConnectionSetup to the UE, followed by 
RRCConnectionSetupComplete sent by the UE to the E-USS. 

c) During registration and after receipt of a AttachRequest from the UE, the E-USS initiates authentication, starts 
integrity by using the security procedure and sends AttachAccept with to the UE: 

TAI (MCC/MNC/TAC):244/010/ 0001 

GUTI: "24401000010266436587" 

d) After receipt of the AttachComplete during registration from the UE, the E-USS sends RRCConnectionRelease. 
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e) The UE is soft powered down. 

7.3.4.5 Acceptance criteria 

1.) After step a) the UE shall send a RRCConnectionRequest on the E-UTRAN-cell related to the BCCH 
transmitting MCC/MNC 244/010 to the e-USS. 

2) After step b) the terminal shall send AttachRequest to the E-USS. 

3) After step c) the terminal shall respond with AttachComplete during registration. 

4) After step e) the USIM shall contain the following values: 
EFepsloci (EPS Information) 

Logically: GUTI: 24401000010266436587 

Last visited registered TAL 244/010/0001 
EPS update status: updated 



Coding: 


B1 


B2 


B3 


B4 


B5 


B6 


B7 


B8 


B9 


BIO 


B11 


Hex 


OB 


F6 


42 


04 


10 


00 


01 


02 


66 


43 


65 


























B12 


B13 


B14 


B15 


B16 


B17 


B18 










87 


42 


04 


10 


00 


01 


00 











7.4 Higher priority PLMN search handling 

7.4.1 UE recognising the search period of the Higher priority PLMN 

7.4.1 .1 Definition and applicability 

The Higher priority PLMN Hst gives in priority order the Higher priority PLMN on which the UE shall register first. 
The Higher priority PLMN search period gives the time interval in which the UE shall search for a possible Higher 
priority PLMN registration. 

The registration attempts initiated by the terminal accessing UTRAN depends on terminal's capabilities and can be one 
of the following: 

7) registration procedures for Ues supporting CS or 

II. registration procedures for Ues supporting PS or 

III. registration procedures for Ues supporting CS/PS 

7.4.1 .2 Conformance requirement 

After registered onto a VPLMN the UE shall take into account the Higher priority PLMN search period timer and the 
priority order of the Higher priority PLMNs in the preferred list on the USIM. 

- TS 22.01 1 [6], subclauses 3.2.2 and 3.2.2.5. 

- TS 24.008 [16], subclause 4.7.5 

7.4.1.3 Test purpose 

To verify that the Higher priority PLMN timer is read and the Higher priority PLMN takes precedence over the 
VPLMN in which the UE is currently registered in. 
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7.4.1.4 Method of test 

7.4.1 .4.1 Initial conditions 

For this test an UTRAN USS (in case of a Terminal accessing UTRAN) or a SS (in case of Terminal accessing a 
GERAN) is needed. 

The USS (in case of a Terminal accessing UTRAN)/ SS (in case of Terminal accessing a GERAN) transmits on BCCH, 
with the following network parameters: 

- Attach/detach: disabled. 

- LAI (MCC/MNC/LAC): 244/082/0001. 

- RAI (MCC/MNC/LAC/RAC): 244/082/0001/05 (only for UTRAN cell). 

Access control: unrestricted. 

After the registration of UE the USS (in case of a Terminal accessing UTRAN) or a SS (in case of Terminal accessing a 
GERAN) transmits on a second BCCH, with the following network parameters: 

- Attach/detach: disabled. 

- LAI (MCC/MNC/LAC): 244/081/0001. 

- RAI (MCC/MNC/LAC/RAC): 244/081/0001/05. (only for UTRAN cell) 

- Access control: unrestricted. 

NOTE: In case of a GERAN no packet system information is transmitted 
The default UICC shall be used with the following exception: 
EFhpplmn (Higher Priority PLMN Search period) 

Logically: set to 6minutes 

Coding: B1 
Hex 01 

The UICC shall be installed into the Terminal and the UE shall be set to automatic PLMN selection mode. 

In case of a Terminal accessing UTRAN "Expected Sequence A" and in case of a Terminal accessing a GERAN 
"Expected Sequence B" shall be performed. 

7.4.1.4.2 Procedure 

Expected sequence A: 

a) The UE shall be powered on. 

b) After receipt of a RRC CONNECTION REQUEST from the UE, the USS shall send RRC CONNECTION 
SETUP to the UE, followed by RRC CONNECTION SETUP COMPLETE sent by the UE to the USS. 

c) Depending on which domain the UE is going to be registered on, one of the following sequences will be passed 
through: 

I. During registration on CS and after receipt of a LOCATION UPDATING REQUEST from the UE, the USS 
initiates authentication, starts integrity by using the security procedure and sends LOCATION UPDATING 
ACCEPT to the UE with the following values: 

LAI (MCC/MNC/LAC): 244/082/0001 

TMSI: "34567890" 
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II. During registration on PS and after receipt of a ATTACH REQUEST from the UE, the USS initiates 
authentication, starts integrity by using the security procedure and sends ATTACH ACCEPT with the 
following values to the UE: 

RAI (MCC/MNC/LAC/RAC) : 244/082/000 1/05 

P-TMSI : "34567890" 

P-TMSI signature value: " AB 1234" 

III. During registration on CS/PS and after receipt of a LOCATION UPDATING REQUEST and/or ATTACH 
REQUEST from the UE, the USS initiates authentication, starts integrity by using the security procedure and 
sends LOCATION UPDATING ACCEPT and/or ATTACH ACCEPT with some of the following values to 
the UE: 

LAI (MCC/MNC/LAC): 244/082/0001 
TMSI: "34567890" 

RAI (MCC/MNC/LAC/RAC) 244/082/000 1/05 

P-TMSI "34567890" 

P-TMSI signature value " AB 1 234" 

d) Depending on which domain the UE is going to be registered on, one of the following sequences will be 
passed through: 

I. After receipt of a TMSI REALLOCATION COMPLETE from the UE during registration on CS, the USS 
sends RRC CONNECTION RELEASE to the UE, followed by RRC CONNECTION RELEASE 
COMPLETE sent by the UE to the USS. 

II. After receipt of a ATTACH COMPLETE from the UE during registration on PS, the USS sends RRC 
CONNECTION RELEASE to the UE, followed by RRC CONNECTION RELEASE COMPLETE sent by 
the UE to the USS or. 

III. After receipt of a TMSI REALLOCATION COMPLETE and/or ATTACH COMPLETE from the UE during 
registration on CS/PS, the USS sends RRC CONNECTION RELEASE to the UE, followed by RRC 
CONNECTION RELEASE COMPLETE sent by the UE to the USS. 

e) The USS starts to send on the second BCCH with the MCC/MNC 244/081. An internal timer shall start to run. 

f) After receipt on the cell related to the BCCH transmitting MCC/MNC 244/08 1 of a RRC CONNECTION 
REQUEST from the UE, the USS sends RRC CONNECTION SETUP to the UE, followed by RRC 
CONNECTION SETUP COMPLETE sent by the UE to the USS. The internal timer is stopped. 

g) Depending on which domain the UE is going to be registered on, one of the following sequences will be passed 
through: 

I. During registration on CS and after receipt of a LOCATION UPDATING REQUEST from the UE, the USS 
initiates authentication, starts integrity by using the security procedure and sends LOCATION UPDATING 
ACCEPT to the UE with following values: 

LAI (MCC/MNC/LAC): 244/081/0001 

TMSI: "12345678" 

II. During registration on PS and after receipt of a ROUTING AREA UPDATE REQUEST from the UE, the 
USS initiates authentication, starts integrity by using the security procedure and sends ROUTING AREA 
UPDATE ACCEPT with the following values to the UE: 

RAI (MCC/MNC/LAC/RAC): 244/081/0001/05 

P-TMSI "12345678" 

P-TMSI signature value " AB 1 234" 
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III. During registration on CS/PS and after receipt of a LOCATION UPDATING REQUEST and/or ROUTING 
AREA UPDATE REQUEST from the UE, the USS initiates authentication, starts integrity by using the 
security procedure and sends LOCATION UPDATING ACCEPT and/or ROUTING AREA UPDATE 
ACCEPT with some of the following values to the UE: 

LAI (MCC/MNC/LAC): 244/081/0001 

TMSI: "12345678" 

RAI(MCC/MNC/LAC/RAC)244/081/0001/05 

P-TMSI "12345678" 

P-TMSI signature value "AB1234" 

h) Depending on which domain the UE is going to be registered on, one of the following sequences will be passed 
through: 

I. After receipt of a TMSI REALLOCATION COMPLETE from the UE during registration on CS, the USS 
sends RRC CONNECTION RELEASE to the UE followed by RRC CONNECTION RELEASE 
COMPLETE sent by the UE to the USS or 

II. After receipt of a ROUTING AREA UPDATE COMPLETE from the UE during registration on PS, the USS 
sends RRC CONNECTION RELEASE to the UE, followed by RRC CONNECTION RELEASE 
COMPLETE sent by the UE to the USS or. 

III. After receipt of a TMSI REALLOCATION COMPLETE and/or ROUTING AREA UPDATE COMPLETE 
from the UE during registration on CS/PS, the USS sends RRC CONNECTION RELEASE to the UE, 
followed by RRC CONNECTION RELEASE COMPLETE sent by the UE to the USS. 

i) The UE is soft powered down. 
Expected sequence B: 

a) The UE shall be powered on. 

b) After receipt of a CHANNEL REQUEST from the UE, the SS shall send IMMEDIATE ASSIGNMENT to the 
UE. 

c) After receipt of a LOCATION UPDATING REQUEST from the UE, the SS sends LOCATION UPDATING 
ACCEPT with: 

LAI (MCC/MNC): 244/082 

TMSI: "34567890" 

to the UE. 

d) After receipt of a TMSI REALLOCATION COMPLETE from the UE, the SS sends CHANNEL RELEASE to 
the UE. 

e) The SS starts to send on the second BCCH with the MCC/MNC 244/081. An internal timer shall start to run. 

f) After receipt of a CHANNEL REQUEST from the UE, the SS sends IMMEDIATE ASSIGNMENT to the UE. 
The internal timer is stopped. 

g) After receipt of a LOCATION UPDATING REQUEST from the UE, the SS sends LOCATION UPDATING 
ACCEPT with: 

LAI (MCC/MNC): 244/08 1 

TMSI: "12345678" 

to the UE. 

h) After receipt of a TMSI REALLOCATION COMPLETE from the UE, the SS sends CHANNEL RELEASE to 
the UE. 
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i) The UE is soft powered down. 



7.4.1.5 Acceptance criteria 

1) After step e) the UE accessing a GERAN shall send CHANNEL REQUEST on the cell related to the BCCH 
transmittingMCC/MNC 244/081 to the SS and the UE accessing UTRAN shall send an RRC CONNECTION 
REQUEST on the cell related to the BCCH transmitting MCC/MNC 244/081 to the USS 

2) After.step e) the UE accessing a GERAN shall send LOCATION UPDATING REQUEST to the SS and the UE 
accessing UTRAN shall send 

I. LOCATION UPDATING REQUEST to the USS during registration on CS or 

II. ROUTING AREA UPDATE REQUEST during registration on PS or 

III. LOCATION UPDATING REQUEST and/or ROUTING AREA UPDATE REQUEST to the USS during 
registration on CS/PS. 

3) After step g) the UE accessing a GERAN shall respond with TMSI REALLOCATION COMPLETE and the 
UE accessing UTRAN shall respond with 

I. TMSI REALLOCATION COMPLETE to the USS during registration on CS or 

II. ROUTING AREA UPDATE COMPLETE during registration on PS or 

III. TMSI REALLOCATION COMPLETE and/or ROUTING AREA UPDATE COMPLETE to the USS during 
registration on CS/PS. 

4) The value of the internal timer shall not exceed 6 minutes. 

NOTE: To take the systems processing time into account, the value of the internal timer may allowed to be a 
guard time of 10 % greater than the required 6 minutes. 

7) After step i) the USIM shall contain the following values: 

For Ues accessing GERAN and Ues accessing UTRAN and supporting (CS and PS) or (CS only): 

EFloci (Location Information) 

Logically: LAI-MCC: 244 

LAI-MNC: 081 
TMSI: "12345678" 

Coding: B1 B2 B3 B4 B5 B6 B7 B8 B9 B10 B11 

Hex 12 34 56 78 42 14 80 xx xx xx 00 



For Ues supporting (CS and PS) or (PS only): 
EFpsLoci (Location Information) 

Logically: RAI-MCC: 244 

RAI-MNC: 081 
P-TMSI: "12345678" 



Coding: 


B1 


B2 


B3 


B4 


B5 


B6 


B7 


B8 


B9 


BIO 


B11 


Hex 


12 


34 


56 


78 


XX 


XX 


XX 


42 


14 


80 


XX 


Coding: 


B12 


B13 


B14 


















Hex 


XX 


XX 


00 
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7.4.2 GSM/UMTS dual mode UEs recognising the search period of the 
Higher priority PLMN 

7.4.2.1 Definition and applicability 

The Higher priority PLMN handUng is defined in TS 22.01 1 [6] . The Higher priority PLMN search period gives the 
time interval between searches for a higher priority PLMN. 

The registration attempts initiated by the UE depends on UEs capabilities and can be one of the following: 

7) registration procedures for UEs supporting CS or 

n. registration procedures for UEs supporting PS or 

in. registration procedures for UEs supporting CS/PS 
To avoid a duplication of tests, this test supersede the previous test case (7.4.1). 

7.4.2.2 Conformance requirement 

After registered onto a VPLMN the UE shall take into account the Higher priority PLMN search period timer and the 
priority order of the Higher priority PLMNs in the preferred lists on the USIM including the Access Technology 
Identifier. 

- TS 22.01 1 [6], subclauses 3.2.2 and 3.2.2.5. 

7.4.2.3 Test purpose 

To verify that the Higher priority PLMN timer is read and the Higher priority PLMN with the higher priority (defined 
according to the selection order in TS 22.01 1 [6]) takes precedence over the VPLMN in which the UE is currently 
registered in. 

7.4.2.4 Method of test 
7.4.2.4.1 Initial conditions 

For this test both a GSM SS and an UTRAN USS are needed. 

The GSM SS transmits on BCCH, with the following network parameters: 

- Attach/detach: disabled. 

- LAI (MCC/MNC/LAC): 244/082/0001. 

- Access control: unrestricted. 

After the registration of UE the GSM SS transmits on a second BCCH, with the following network parameters: 

- Attach/detach: disabled. 

- LAI (MCC/MNC/LAC): 244/081/0001. 

Access control: unrestricted. 

At the same time as the SS sends on a second BCCH, the UMTS USS transmits on BCCH, with the following network 
parameters: 

- Attach/detach: disabled. 

- LAI (MCC/MNC/LAC): 244/081/0001. 

- RAI (MCC/MNC/LAC/RAC): 244/081/0001/05. 
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- Access control: unrestricted. 

The default UICC is used with the following exception: 

EFhplmnwact (HPLMN selector with Access Technology) 

Logically: Set to MCC 244 and MNC 08 1 

Set to UTRAN 



Coding: B1 
Hex 42 



B2 
14 



B3 
80 



B4 
80 



B5 
00 



EFhpplmn (Higher Priority HPLMN Search period) 

Logically: set to 6niinutes 

Coding: B1 
Hex 01 



EFusT (USIM Service Table) 

Logically: Local Phone Book available 

User controlled PLMN selector available 
Fixed dialling numbers available 
Barred dialling numbers available 
The GSM Access available 

The Group Identifier level 1 and level 2 not available 
Service n 33 (Packed Switched Domain) shall be set to T 
Enabled Services Table available 
HPLMN selector with access technology available 



Coding: 
binary 



B1 

XXl X xxl 1 



B2 

xxxx xxxx 



B3 

xxxx 1 xOO 



B4 

xxxx Xl XX 



B5 

xxxx xxl 1 



B6 

xxxx xl XX 



The UICC is installed into the Terminal and the UE is set to automatic PLMN selection mode. 



7.4.2.4.2 Procedure 

a) The UE is powered on. 

b) After receipt of a CHANNEL REQUEST from the UE, the SS sends IMMEDIATE ASSIGNMENT to the UE. 

c) After receipt of a LOCATION UPDATING REQUEST from the UE, the SS sends LOCATION UPDATING 
ACCEPT with: 



LAI (MCC/MNC): 
TMSI: 
to the UE. 



244/082 
"34567890" 



d) After receipt of a TMSI REALLOCATION COMPLETE from the UE, the SS sends CHANNEL RELEASE to 
the UE. 

e) The SS starts to send on the second BCCH with the MCC/MNC 244/081 and the USS starts to send with the 
Same MCC/MNC. An internal timer shall start to run. 

f) After receipt of a RRC CONNECTION REQUEST on the UTRAN-cell related to the BCCH transmitting 
MCC/MNC 244/081 from the UE, the USS sends RRC CONNECTION SETUP to the UE, followed by RRC 
CONNECTION SETUP COMPLETE sent by the UE to the USS. The internal timer is stopped. 
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g) Depending on which domain the UE is going to be registered on, one of the following sequences will be passed 
through: 

I. During registration on CS and after receipt of a LOCATION UPDATING REQUEST from the UE, the USS 
initiates authentication, starts integrity by using the security procedure and sends LOCATION UPDATING 
ACCEPT with the following values to the UE: 

LAI (MCC/MNC/LAC): 244/081/0001 

TMSI: "12345678" 

II. During registration on PS and after receipt of a ATTACH REQUEST from the UE, the USS initiates 
authentication, starts integrity by using the security procedure and sends ATTACH ACCEPT with the 
following values to the UE: 

RAI(MCC/MNC/LAC/RAC)244/081/0001/05 

P-TMSI "12345678" 

P-TMSI signature value " AB 1234" 

III. During registration on CS/PS and after receipt of a LOCATION UPDATING REQUEST and/or ATTACH 
REQUEST from the UE, the USS initiates authentication, starts integrity by using the security procedure and 
sends LOCATION UPDATING ACCEPT and/or ATTACH ACCEPT with some of the following values to 
the UE: 

LAI (MCC/MNC/LAC): 244/081/0001 
TMSI: "12345678" 
RAI(MCC/MNC/LAC/RAC)244/081/0001/05 
P-TMSI "12345678" 
P-TMSI signature value " AB 1 234" 

h) Depending on which domain the UE is going to be registered on, one of the following sequences will be passed 
through: 

I. After receipt of a TMSI REALLOCATION COMPLETE from the UE during registration on CS, the USS 
sends RRC CONNECTION RELEASE to the UE, followed by RRC CONNECTION RELEASE 
COMPLETE sent by the UE to the USS or 

II. After receipt of a ATTACH COMPLETE from the UE during registration on PS, the USS sends RRC 
CONNECTION RELEASE to the UE, followed by RRC CONNECTION RELEASE COMPLETE sent by 
the UE to the USS or. 

III. After receipt of a TMSI REALLOCATION COMPLETE and/or ATTACH COMPLETE from the UE during 
registration on CS/PS, the USS sends RRC CONNECTION RELEASE to the UE, followed by RRC 
CONNECTION RELEASE COMPLETE sent by the UE to the USS. 

i) The UE is soft powered down. 

7.4.2.5 Acceptance criteria 

1) After step e) the UE shall send an RRC CONNECTION REQUEST on the UTRAN-cell related to the BCCH 
transmitting MCC/MNC 244/081 to the USS. 

2) After step e) the UE shall send 

I. LOCATION UPDATING REQUEST to the USS during registration on CS or 

II. ATTACH REQUEST during registration on PS or 

III. LOCATION UPDATING REQUEST and/or ATTACH REQUEST to the USS during registration on CS/PS. 
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3) After step g) the UE shall respond with 

I. TMSI REALLOCATION COMPLETE during registration on CS or 
IL ATTACH COMPLETE during registration on PS or 

m. TMSI REALLOCATION COMPLETE and/or ATTACH COMPLETE to the USS during registration on 
CS/PS. 

4) The value of the internal timer shall not exceed 6 minutes. 

NOTE: To take the systems processing time into account, the value of the internal timer may allowed to be a 
guard time of 10 % greater than the required 6 minutes. 

7) After step i) the USIM shall contain the following values: 

For Ues supporting (CS and PS) or (CS only): 

EFloci (Location Information) 

Logically: LAI-MCC: 244 

LAI-MNC: 081 
TMSI: "12345678" 



Coding: B1 
Hex 12 



B2 
34 



B3 
56 



84 
78 



B5 
42 



B6 
14 



87 
80 



B8 

XX 



B9 

XX 



BIO 

XX 



B11 
00 



For Ues supporting (CS and PS) or (PS only): 

EFpsLoci (Location Information) 

Logically: RAI-MCC: 244 

RAI-MNC: 081 
P-TMSI: "12345678" 



Coding: 


B1 


B2 


B3 


B4 


B5 


B6 


B7 


B8 


B9 


BIO 


B11 


Hex 


12 


34 


56 


78 


XX 


XX 


XX 


42 


14 


80 


XX 


Coding: 


B12 


B13 


B14 


















Hex 


XX 


XX 


00 



















7.4.3 UE recognising the search period of the Higher priority PLMN - E- 
UTRAN 



7.4.3.1 Definition and applicability 

The Higher priority PLMN hst gives in priority order the Higher priority PLMN on which the UE shall register first. 
The Higher priority PLMN search period gives the time interval in which the UE shall search for a possible Higher 
priority PLMN registration. 



7.4.3.2 Conformance requirement 

After registered onto a VPLMN the UE shall take into account the Higher priority PLMN search period timer and the 
priority order of the Higher priority PLMNs in the preferred lists on the USIM. 

- TS 22.011 [6], subclauses 3.2.2 and 3.2.2.5. 

- TS 24.301 [26], subclause 5.5.3.2 
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7.4.3.3 Test purpose 

To verify that the Higher priority PLMN timer is read and the Higher priority PLMN takes precedence over the 
VPLMN in which the UE is currently registered in. Hereby the new coding for RAT E-UTRAN has to be handled 
correctly by the UE. 

7.4.3.4 Method of test 

7.4.3.4.1 Initial conditions 

For this test an E-USS is required. 

The E-USS transmits on BCCH with the following network parameters: 

- TAI (MCC/MNC/TAC): 244/008/0001. 

- Access control: unrestricted. 

After the registration of UE the E-USS transmits on a second BCCH with the following network parameters: 

- TAI (MCC/MNC/TAC): 244/083/0001. 
~ Access control: unrestricted. 

The default E-UTRAN UICC shall be used with the following exception: 
EFhpplmn (Higher Priority PLMN Search period) 
Logically: set to 6minutes 

Coding: B1 
Hex 01 

The UICC shall be installed into the Terminal and the UE shall be set to automatic PLMN selection mode. 

7.4.3.4.2 Procedure 

a) The UE is powered on. 

b) After receipt of an RRCConnectionRequest from the UE on the E-UTRAN-cell related to the BCCH transmitting 
MCC/MNC 244/008, the E-USS sends RRCConnectionSetup to the UE, followed by 
RRCConnectionSetupComplete sent by the UE to the E-USS. 

c) During registration and after receipt of a AttachRequest from the UE, the E-USS initiates authentication, starts 
integrity by using the security procedure and sends AttachAccept with to the UE: 

TAI (MCC/MNC/TAC):244/008/ 0001 

GUTI: "24400800010266436587" 

d) After receipt of the AttachComplete during registration from the UE, the E-USS sends RRCConnectionRelease. 

e) The USS starts to send on the second BCCH with the MCC/MNC 244/083. An internal timer shall start to run. 

f) After receipt of an RRCConnectionRequest from the UE on the E-UTRAN-cell related to the BCCH transmitting 
MCC/MNC 244/083, the E-USS sends RRCConnectionSetup to the UE, followed by 
RRCConnectionSetupComplete sent by the UE to the E-USS. 
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g) During registration and after receipt of a TrackingAreaUpdateRequest from the UE, the E-USS initiates 
authentication, starts integrity by using the security procedure and sends TrackingAreaUpdateAccept with to the 
UE: 

TAI (MCC/MNC/TAC):244/083/ 0001 

GUTI: "24408300010266436587" 

h) After receipt of the TrackingAreaUpdatComplete during registration from the UE, the E-USS sends 
RR CConnectionRelease . 

i) The UE is soft powered down. 

7.4.3.5 Acceptance criteria 

1.) After step e) the UE shall send a RRCConnectionRequest on the E-UTRAN-cell related to the BCCH 
transmitting MCC/MNC 244/083 to the e-USS. 

2) After step f) the terminal shall send TrackingAreaUpdateReques to the E-USS. 

3) After step g) the terminal shall respond with TrackingAreaUpdatComplete during registration. 

4) After step i) the USIM shall contain the following values: 
EFepsloci (EPS Information) 

Logically: GUTI: 24408300010266436587 

Last visited registered TAL 244/083/0001 
EPS update status: updated 



Coding: 


B1 


B2 


B3 


B4 


B5 


B6 


B7 


B8 


B9 


BIO 


B11 


Hex 


OB 


F6 


42 


34 


80 


00 


01 


02 


66 


43 


65 


























B12 


B13 


B14 


B15 


B16 


B17 


B18 










87 


42 


34 


80 


00 


01 


00 











7.4.4 E-UTRAN/EPC capable UEs recognising the search period of the 
Higher priority PLMN - GSM/E-UTRAN 

7.4.4.1 Definition and applicability 

The Higher priority PLMN handhng is defined in TS 22.01 1 [6]. The Higher priority PLMN search period gives the 
time interval between searches for a higher priority PLMN. 

To avoid a duplication of tests, this test supersedes the previous test case (7.4.3). 

7.4.4.2 Conformance requirement 

After registered onto a VPLMN the UE shall take into account the Higher priority PLMN search period timer and the 
priority order of the Higher priority PLMNs in the preferred lists on the USIM including the Access Technology 
Identifier. 

- TS 22.011 [6], subclauses 3.2.2 and 3.2.2.5. 

7.4.4.3 Test purpose 

To verify that the Higher priority PLMN timer is read and the Higher priority PLMN with the higher priority (defined 
according to the selection order in TS 22.01 1 [6]) takes precedence over the VPLMN in which the UE is currently 
registered in. Hereby the new coding for RAT E-UTRAN has to be handled correctly by the UE. 
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7.4.4.4 Method of test 
7.4.4.4.1 Initial conditions 

For this test both a GSM SS and an E-UTRAN E-USS are needed. 

The GSM SS transmits on BCCH, with the following network parameters: 

- Attach/detach: disabled. 

- LAI (MCC/MNC/LAC): 244/082/0001. 

- RAI (MCC/MNC/LAC/RAC): 244/082/0001/05. 

- Access control: unrestricted. 

After the registration of UE the GSM SS transmits on a second BCCH, with the following network parameters: 

- Attach/detach: disabled. 

- LAI (MCC/MNC/LAC): 244/081/0001. 

- RAI (MCC/MNC/LAC/RAC): 244/081/0001/05. 

- Access control: unrestricted. 

At the same time as the SS sends on a second BCCH, the E- USS transmits on BCCH, with the following network 
parameters: 

- TAI (MCC/MNC/TAC): 244/081/0001. 
~ Access control: unrestricted. 

The default E-UTRAN UICC is used with the following exception: 

EFhplmnwact (HPLMN selector with Access Technology) 

Logically: Set to MCC 244 and MNC 08 1 

Set to 

E-UTRAN 

Coding: B1 B2 B3 B4 B5 
Hex 42 14 80 40 00 

EFhpplmn (Higher Priority HPLMN Search period) 

Logically: set to 6minutes 

Coding: B1 
Hex 01 

EFusT (USIM Service Table) 

Logically: Local Phone Book available 

User controlled PLMN selector available 
Fixed dialling numbers available 
Barred dialling numbers available 
The GSM Access available 

The Group Identifier level 1 and level 2 not available 
Service n 33 (Packed Switched Domain) shall be set to T 
Enabled Services Table available 
HPLMN selector with access technology available 
EPS Mobility Management Information available 
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Allowed CSG Lists and corresponding indications not available 

Coding: B1 82 B3 B4 85 B6 B7 88 

Binary xx1 x xx1 1 xxxx xxxx xxxx 1 xOO xxxx x1 xx xxxx xx1 1 xxxx x1 xx xxxx xxxx xxxx xxxx 

89 B10 B11 

xxxx xxxx xxxx xxxx xx01 xxxx 

The UICC is installed into the Terminal, the UE is set to automatic PLMN selection mode and to auto GPRS attach.. 

7.4.4.4.2 Procedure 

a) The UE is powered on. 

b) After receipt of a CHANNEL REQUEST from the UE, the SS sends IMMEDIATE ASSIGNMENT to the UE. 

c) After receipt of an ATTACH REQUEST from the UE, the SS sends ATTACH ACCEPT with: 

RAI (MCC/MNC/LAC/RAC): 244/082/0001/05 
TMSI: "34567890" 
to the UE. 

d) After receipt of a ATTACH COMPLETE from the UE, the SS sends CHANNEL RELEASE to the UE. 

e) The SS starts to send on the second BCCH with the MCC/MNC 244/081 and the E-USS starts to send with the 
Same MCC/MNC. An internal timer shall start to run. 

f) After receipt of an RRCConnectionRequest from the UE on the E-UTRAN-cell related to the BCCH transmitting 
MCC/MNC 244/081, the E-USS sends RRCConnectionSetup to the UE, followed by 
RRCConnectionSetupComplete sent by the UE to the E-USS. 

g) During registration and after receipt of a TrackingAreaUpdateRequest from the UE, the E-USS initiates 
authentication, starts integrity by using the security procedure and sends TrackingAreaUpdateAccept with to the 
UE: 

TAI (MCC/MNC/TAC):244/081/ 0001 

GUTI: "24408 1 000 1 02664365 87 " 

h) After receipt of the TrackingAreaUpdatComplete during registration from the UE, the E-USS sends 
RRCConnectionRelease. 

i) The UE is soft powered down. 

lAA.b Acceptance criteria 

1.) After step e) the UE shall send a RRCConnectionRequest on the E-UTRAN-cell related to the BCCH 
transmitting MCC/MNC 244/081 to the e-USS. 

2) After step f) the terminal shall send TrackingAreaUpdateReques to the E-USS. 

3) After step g) the terminal shall respond with TrackingAreaUpdatComplete during registration. 

4) After step i) the USIM shall contain the following values: 
EFepsloci (EPS Information) 

Logically: GUTI: 24408100010266436587 

Last visited registered TAI: 244/081/0001 
EPS update status: updated 
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Coding: 


B1 


B2 


B3 


B4 


B5 


B6 


B7 


B8 


B9 


BIO 


B11 


Hex 


OB 


F6 


42 


14 


80 


00 


01 


02 


66 


43 


65 


























B12 


B13 


B14 


B15 


B16 


B17 


B18 










87 


42 


14 


80 


00 


01 


00 











7.4.5 E-UTRAN/EPC capable UEs recognising the search period of the 
Higher priority PLMN - UTRAN/E-UTRAN 

7.4.5.1 Definition and applicability 

The Higher priority PLMN Hst gives in priority order the Higher priority PLMN on which the UE shall register first. 
The Radio Access Technology identifier defines the Radio network in which the UE shall register. The list is stored on 
the USIM in the EFhplmnwact- The Higher priority PLMN search period gives the time interval in which the UE shall 
search for a possible Higher priority PLMN registration. 

To avoid a duplication of tests, this test supersedes test 7.4.x. 

7.4.5.2 Conformance requirement 

After registered onto a VPLMN the UE shall take into account the Higher priority PLMN search period timer and the 
priority order of the Higher priority PLMNs in the preferred list on the USIM including the Access Technology 
Identifier. 

- TS 22.01 1 [6], subclauses 3.2.2 and 3.2.2.5. 

7.4.5.3 Test purpose 

To verify that the Higher priority PLMN timer is read and the Higher priority PLMN with the higher priority (defined 
by its position in EFhplmnwact) takes precedence over the VPLMN in which the UE is currently registered in. Hereby 
the new coding for RAT E-UTRAN has to be handled correctly by the UE. 

7.4.5.4 Method of test 
7.4.5.4.1 Initial conditions 

For this test both a UTRAN USS and an E-UTRAN E-USS are needed. 
The USS transmits on BCCH, with the following network parameters: 

- Attach/detach: disabled. 

- LAI (MCC/MNC/LAC): 244/009/0001. 

- RAI (MCC/MNC/LAC/RAC): 244/009/0001/05. 

- Access control: unrestricted. 

After the registration of UE the USS transmits on a second BCCH, with the following network parameters: 

- Attach/detach: disabled. 

- LAI (MCC/MNC/LAC): 244/081/0001. 

- RAI (MCC/MNC/LAC/RAC): 244/081/0001/05. 

- Access control: unrestricted. 
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At the same time as the SS sends on a second BCCH, the E- USS transmits on BCCH, with the following network 
parameters: 

- TAI (MCC/MNC/TAC): 244/081/0001. 

~ Access control: unrestricted. 

The default E-UTRAN UICC is used with the following exception: 

EFhplmnwact (HPLMN selector with Access Technology) 

Logically: Set to MCC 244 and MNC 08 1 

Set to 

E-UTRAN 

Coding: B1 B2 B3 84 B5 
Hex 42 14 80 40 00 

EFhpplmn (Higher Priority HPLMN Search period) 

Logically: set to 6minutes 

Coding: B1 
Hex 01 

EFusT (USIM Service Table) 

Logically: Local Phone Book available 

User controlled PLMN selector available 
Fixed dialling numbers available 
Barred dialling numbers available 
The GSM Access available 

The Group Identifier level 1 and level 2 not available 

Service n 33 (Packed Switched Domain) shall be set to T 

Enabled Services Table available 

HPLMN selector with access technology available 

EPS Mobility Management Information available 

Allowed CSG Lists and corresponding indications not available 

Coding: 81 B2 B3 B4 85 B6 B7 88 

8inary xxl x xxl 1 xxxx xxxx xxxx 1 xOO xxxx x1 xx xxxx xxl 1 xxxx x1 xx xxxx xxxx xxxx xxxx 

89 810 811 

xxxx xxxx xxxx xxxx xxOI xxxx 

The UICC is installed into the Terminal, the UE is set to automatic PLMN selection mode and to auto GPRS attach. 

7.4.5.4.2 Procedure 

a) The UE is powered on. 

b) After receipt of a RRC CONNECTION REQUEST from the UE, the USS shall send RRC CONNECTION 
SETUP to the UE, followed by RRC CONNECTION SETUP COMPLETE sent by the UE to the USS. 

c) After receipt of an ATTACH REQUEST from the UE, the SS sends ATTACH ACCEPT with: 

RAI (MCC/MNC/LAC/RAC): 244/009/0001/05 
TMSI: "34567890" 
to the UE. 
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d) After receipt of a ATTACH COMPLETE from the UE, the USS sends RRC CONNECTION RELEASE to the 
UE, followed by RRC CONNECTION RELEASE COMPLETE sent by the UE to the USS. 

e) TheUSS starts to send on the second BCCH with the MCC/MNC 244/081 and the E-USS starts to send with the 
Same MCC/MNC. An internal timer shall start to run. 

f) After receipt of an RRCConnectionRequest from the UE on the E-UTRAN-cell related to the BCCH transmitting 
MCC/MNC 244/081, the E-USS sends RRCConnectionSetup to the UE, followed by 
RRCConnectionSetupComplete sent by the UE to the E-USS. 

g) During registration and after receipt of a Tracking AreaUpdateRequest from the UE, the E-USS initiates 
authentication, starts integrity by using the security procedure and sends TrackingAreaUpdateAccept with to the 
UE: 

TAI (MCC/MNC/TAC):244/081/ 0001 

GUTI: "24408100010266436587" 

h) After receipt of the TrackingAreaUpdatComplete during registration from the UE, the E-USS sends 
RR CConnectionRelease . 

i) The UE is soft powered down. 

7.4.5.5 Acceptance criteria 

1.) After step e) the UE shall send a RRCConnectionRequest on the E-UTRAN-cell related to the BCCH 
transmitting MCC/MNC 244/081 to the e-USS. 

2) After step f) the terminal shall send TrackingAreaUpdateReques to the E-USS. 

3) After step g) the terminal shall respond with TrackingAreaUpdatComplete during registration. 

4) After step i) the USIM shall contain the following values: 
EFepsloci (EPS Information) 

Logically: GUTI: 24408100010266436587 

Last visited registered TAI: 244/081/0001 
EPS update status: updated 



Coding: 


B1 


B2 


B3 


B4 


B5 


B6 


B7 


B8 


B9 


BIO 


B11 


Hex 


OB 


F6 


42 


14 


80 


00 


01 


02 


66 


43 


65 


























B12 


B13 


B14 


B15 


B16 


B17 


B18 










87 


42 


14 


80 


00 


01 


00 











7.5 Void 
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8 Subscription independent tests 

8.1 Phone book procedures 

8.1 .1 Recognition of a previously changed phonebook 

8.1 .1 .1 Definition and applicability 

If the UICC is inserted into a GERAN Rel-4 or earlier terminal, the phonebook may have been altered in this GSM 
session. If the ADN entry has been changed or deleted, the GSM terminal will not be able to change the appropriate 
additional phonebook entries (e.g. EFanr Additional Number). In that case the UICC shall set a flag in the appropriate 
EFpBc (phonebook Control). If the UICC is inserted in a 3G or GERAN Terminal, the 3G or GERAN Terminal shall 
recognise the flag and the phonebook shall be synchronised by the Terminal. Once the Terminal recognise the set flag 
in the EFpBc, the Terminal shall update the Change Counter in the EFcc- 

8.1 .1 .2 Conformance requirement 

The 3G or GERAN Terminal shall recognise the set flag in the EFpBc and then synchronise the phonebook. The 
Terminal shall also update EFcc (Change Counter). 

- TS 31.102 [4], subclause 4.4.2. 

8.1.1.3 Test purpose 

1) To verify that the Terminal has recognised that the phonebook has been altered by a GSM Terminal. 

2) To verify that the Terminal does the synchronising of the changed phonebook entries. 

3) To verify that the Terminal updates the EFpBc and EFcc- 

8.1.1.4 Method of test 



8.1.1.4.1 Initial conditions 

No USS is needed for this test. 

The default UICC is used with the following exception: 
EFadn (Abbreviated Dialling Number) 



Logically: 
Record 1: 



Length of alpha identifier: 32 characters; 



Alpha identifier: 
Length of BCD number: 
TON and NPI: 
Dialled number: 
CCI: 
Extl: 



"ABCDEFGHIJKLMNOPQRSTUVWXYZABCDEF"; 

"03"; 

Telephony and Unknown; 

123; 

None; 

None. 



Record 1: 



Coding: 
Hex 



B1 
41 



B2 
42 



B3 
43 



B32 B33 B34 B35 B36 B37 B38 B39 
46 03 81 21 F3 FF FF FF 



B46 
FF 



EFpBc (Phonebook Control) 

Logically: 

Record 1: The ADN Record No. 1 has been hanged by a GSM terminal. 
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Related ADN record is not hidden. 

Coding: B1 B2 
Hex 01 00 

EFcc (Change Counter) 

Logically: "GOOF" 

Coding: B1 82 
Hex 00 OF 

The UICC is installed into the Terminal 

8.1.1.4.2 Procedure 

a) The Terminal is powered on. 

b) The Terminal shall stay powered on until the phonebook synchronisation procedures are finished. If the 
synchronisation is indicated by the Terminal, the Terminal shall only powered down after this indication is 
vanished. 



8.1.1.5 Acceptance criteria 

After step b) the USIM shall contain the following values: 
EFpBc (Phonebook Control) 

Logically: 

Record 1 : The entry control information is reset. 

Related ADN record is not hidden. 



Coding: B1 B2 
Hex 00 00 



EFcc (Change Counter) 

Logically: The counter is incremented to "0010" 

Coding: B1 82 
Hex 00 10 



8.1 .2 Update of the Phonebook Synchronisation Counter (PSC) 

8.1 .2.1 Definition and applicability 

The phonebook synchronisation Counter is used to unambiguously identify the status of the phonebook. Every time the 
phonebook is reset/deleted or the UID and/or the CC has run out of range, the PSC shall be regenerated. 

The PSC is a part of the phonebook identifier. 

8.1 .2.2 Conformance requirement 

Every time either the UID or the CC is incremented by the Terminal, the value of the contend of the appropriate EF 
shall be tested. If either UID or CC has reached "FF FF", the related EF shall be set to "00 01" and the PSC is 
incremented. 

- TS 31.102 [4], subclause 4.4.2.12.2. 
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8.1.2.3 Test purpose 

1) To verify that the Terminal has recognised that the values of UID and CC has changed. 

2) To verify that the Terminal resets the value of EFuid and EFcc- 

3) To verify that the Terminal updates EFpsc- 

8.1.2.4 Method of test 

8.1 .2.4.1 Initial conditions 

No USS is needed for this test. 

The default UICC is used with the following exception: 
EFuiD (Unique Identifier) 

Logically: one record is set to "FF FF" 

Coding: B1 B2 
Hex FF FF 

EFpuiD (Previous Unique Identifier) 

Logically: is set to "FF FF" 

Coding: B1 82 
Hex FF FF 

EFcc (Change Counter) 

Logically: set to "FF FF" 

Coding: B1 B2 
Hex FF FF 

EFpsc (Phonebook Synchronisation Counter) 

Logically: set to "00 00 FF FF" 

Coding: 81 B2 B3 B4 
Hex 00 00 FF FF 

At least one phonebook entry shall be empty and available for creating a new entry (e.g. an appropriate ADN record). 
The UICC is installed into the Terminal and the UE is powered on and the correct PIN is entered. 

8.1.2.4.2 Procedure 

a) A new phonebook entry shall be created. 

NOTE 1: This may be done by storing a new telephone number in an empty ADN record. 

b) The UE shall have given the time to perform the regeneration of the UID records. 

NOTE 2: It is assumed that the UE will indicate the time it needs to perform the regeneration by displaying a busy 
signal to the user. 
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8.1 .2.5 Acceptance criteria 

After step b) the USIM shall contain the following values: 

The EFuiD (Unique Identifier) shall have been regenerated with UID values starting with "00 01". The UID values may 
be stored in any order, but shall be unique. The entry in EFuid with value FF FF (the maximum value) shall have been 
replaced by an appropriate value which shall be distinguishable to the maximum value. EFpuio shall contain a UID 
value (other than FFFF) that is present in EFuid. 

EFcc (Change Counter) 

Logically: set to "00 01" 

Coding: B1 B2 
Hex 00 01 

EFpsc (Phonebook Synchronisation Counter) 

Logically: set to "00 01 00 00" 

Coding: B1 82 B3 B4 
Hex 00 01 00 00 

8.1 .3 Phonebook content handling 

8.1 .3.1 Handling of BCD number/ SSC content extension 

8.1 .3.1 .1 Definition and applicability 

The length of BCD number/SSC contents in EFadn byte gives the number of bytes of the following two data items 
containing actual BCD number/SSC information. This means that the maximum value is 1 1, even when the actual 
ADN/SSC information length is greater than 11. When an ADN/SSC has extension, it is indicated by the extensionl 
identifier being unequal to 'FF'. The remainder is stored in the EFexti with the remaining length of the additional 
data being coded in the appropriate additional record itself. 

8.1 .3.1 .2 Conformance requirement 

The terminal shall support the BCD number/ SSC extension for EFadn as defined in TS 31.102 [4], subclauses 
4.4.2.3 and 4.4.2.4. 

Reference: 

- TS 31.102 [4], subclauses 4.4.2.3 and 4.4.2.4. 

8.1.3.1.3 Test purpose 

1) To verify that the terminal is able to read and update BCD numbers/ SSC content with and without extension 
correctly in EFadn and EFexti- 

8.1.3.1.4 Method of test 

8.1 .3.1 .4.1 Initial conditions 

The terminal is connected to the USIM Simulator. 

Prior to the test execution the terminal manufacturer shall state the maximum number of BCD digits (excluding 
TON/NPI), which are supported by the terminal for global phonebook updating. 

The default USIM is used with the following exceptions: 
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Only the global phonebook is present. 
The global phonebook shall contain: 
EFpBR (Phonebook reference file) 

Logically: Only EFadn and EFexti are present in the global phonebook. 

EFadn (Abbreviated dialling numbers) 

Logically: 

10 records, each record non-empty and unique. Unless otherwise stated, the ADN records shall not use extended 
BCD numbers/SSC strings. 



Record 1: 



Length of alpha identifier: 32 characters; 



Alpha identifier: 
Length of BCD number: 
TON and NPL 
Dialled number: 
CCL 
Extl: 



"ContactOOl"; 
11; 

Telephony and International; 

"00112233445566778899"; 

'FF'; 

01. 



Record 1: 



Coding: 


B1 


B2 


B3 


B4 


B5 


B6 


B7 


B8 


B9 


BIO 


B11 




B32 


Hex 


43 


6F 


6E 


74 


61 


63 


74 


30 


30 


31 


FF 




FF 




B34 


B35 


B36 


B37 


B38 


B39 


B40 


B41 


B42 


B43 


B44 


B45 


B46 




91 


00 


11 


22 


33 


44 


55 


66 


77 


88 


99 


FF 


01 



OB 



Record 2: 



Length of alpha identifier: 32 characters; 
Alpha identifier: 
Length of BCD number: 
TON and NPL 
Dialled number: 
CCL 



Extl: 



"Contact002"; 

11; 

Telephony and International; 
"01234567890123456789"; 
'FF'; 



'FF'. 



Record 2: 



Coding: 


B1 


B2 


B3 


B4 


B5 


B6 


B7 


B8 


B9 


B10 


B11 




B32 


Hex 


43 


6F 


6E 


74 


61 


63 


74 


30 


30 


32 


FF 




FF 




B34 


B35 


B36 


B37 


B38 


B39 


B40 


B41 


B42 


B43 


B44 


B45 


B46 




91 


10 


32 


54 


76 


98 


10 


32 


54 


76 


98 


FF 


FF 



OB 



Record 3: Length of alpha identifier: 32 characters; 

Alpha identifier: 
Length of BCD number: 
TON and NPI: 
Dialled number: 
CCI: 
Extl: 



"Contact003"; 
11; 

Telephony and International; 
"99887766554433221100"; 
'FF'; 
'02'. 



Record 3: 
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Coding: 


B1 


B2 


B3 


B4 


B5 


B6 


B7 


B8 


B9 


BIO 


B11 




B32 


B33 


Hex 


43 


6F 


6E 


74 


61 


63 


74 


30 


30 


33 


FF 




FF 


OB 




B34 


B35 


B36 


B37 


B38 


B39 


B40 


B41 


B42 


B43 


B44 


B45 


B46 






91 


99 


88 


77 


66 


55 


44 


33 


22 


11 


00 


FF 


02 





Record 4: 



Record 4: 



Length of alpha identifier: 32 characters; 
Alpha identifier: 
Length of BCD number: 
TON and NPL 
Dialled number: 
CCL 



Extl: 



"Contact004"; 
9; 

Telephony and International; 
"1212121212121212"; 
'FF'; 



'FF'. 



Coding: 
Hex 



B1 


B2 


B3 


B4 


B5 


B6 


B7 


B8 


B9 


BIO 


B11 




B32 


B33 


43 


6F 


6E 


74 


61 


63 


74 


30 


30 


34 


FF 




FF 


09 


B34 


B35 


B36 


B37 


B38 


B39 


B40 


B41 


B42 


B43 


B44 


B45 


B46 




91 


21 


21 


21 


21 


21 


21 


21 


21 


FF 


FF 


FF 


FF 





Record 7: 



Record 7: 



Length of alpha identifier: 

Alpha identifier: 

Length of BCD number: 

TON and NPI: 

Dialled number: 

CCL 

Extl: 



32 characters; 
"Contact007"; 

3; 

Telephony and International; 

"678"; 

'FF'; 

'FF'. 



Coding: 


B1 


B2 


B3 


B4 


B5 


B6 


B7 


B8 


B9 


BIO 


B11 




B32 


B33 


Hex 


43 


6F 


6E 


74 


61 


63 


74 


30 


30 


37 


FF 




FF 


03 




B34 


B35 


B36 


B37 


B38 


B39 


B40 


B41 


B42 


B43 


B44 


B45 


B46 






91 


76 


F8 


FF 


FF 


FF 


FF 


FF 


FF 


FF 


FF 


FF 


FF 





EFexti (Extension 1) 

Logically: 4 records 

Record 1: 



Record type: 
Extension data: 
Identifier: 



'02' 

"01234567890123456789"; 
'FF'. 



Record 1: 

Coding: B1 B2 B3 B4 B5 B6 B7 B8 B9 BIO B11 B12 B13 
Hex 02 OA 10 32 54 76 98 10 32 54 76 98 FF 



Record 2: 



Record type: 
Extension data: 
Identifier: 



'02' 

"99887766554433221100"; 
'03'. 



Record 2: 
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Coding: B1 B2 B3 B4 B5 B6 B7 B8 B9 B10 B11 B12 B13 
Hex 02 OA 99 88 77 66 55 44 33 22 11 00 03 



Record 3: 



Record type: 
Extension data: 
Identifier: 



'02' 

"llpl2345"; 
'FF'. 



Record 3: 

Coding: B1 B2 B3 B4 B5 B6 B7 B8 B9 BIO B11 B12 B13 
Hex 02 04 11 1C 32 54 FF FF FF FF FF FF FF 



Record 4: 



Record type: 
Extension data: 
Identifier: 



'00' 

empty; 
'FF'. 



Record 4: 

Coding: B1 B2 B3 B4 B5 B6 B7 B8 B9 BIO B11 B12 B13 
Hex 00 FF FF FF FF FF FF FF FF FF FF FF FF 



8.1.3.1.4.2 Procedure 

a) The terminal is switched on and the USIM appHcation shall be activated. 

b) The user shall use an MMI dependent procedure to select the global phonebook. 

c) The user shall change the BCD number of the entry "Contact002" to "22446622446622446600777888999". If 
the maximum number of BCD digits supported for the global phonebook update is less than in the requested 
input BCD number string, then the user shall enter the BCD number string as requested, but only up to the 
maximum number of BCD digits which are supported for updating. 

d) The user shall extend the BCD number of the entry "Contact007" to "01234567890123456789777888999".. If 
the maximum number of BCD digits supported for the global phonebook update is less than in the requested 
input BCD number string, then the user shall enter the BCD number string as requested, but only up to the 
maximum number of BCD digits which are supported for updating. 

e) The user shall delete the phonebook entry "ContactOOl". 

f) The user shall set the BCD number of the entry "Contact002" to "22446622446600" 

g) The user shall create the new phonebook entry "NewContact" with the BCD number 
"1234567890123456789012345678901234567890123456789012".. If the maximum number of BCD digits 
supported for the global phonebook update is less than in the requested input BCD number string, then the user 
shall enter the BCD number string as requested, but only up to the maximum number of BCD digits which are 
supported for updating. 

h) The user shall delete the phonebook entry "Contact003". 

i) The terminal is switched off. 



8.1.3.1.5 Acceptance criteria 

1) After step a) the terminal shall have activated the USIM application. 

2) After step b) the terminal shall have selected the global phonebook and shall have read EFpbr in the global 
phonebook. 
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3) After step c) the global phonebook shall contain a record with "22446622446622446600" as BCD number and 
"04" as extension record identifier. EFexti shall contain a record with "Additional data" as record type, the BCD 
number extension "777888999" and "FF" as identifier to indicate the end of the chain. If the maximum number 
of BCD digits supported for global phonebook updating is less than in the requested input BCD number, then 
EFadn and EFexti shall contain the BCD number as entered on the MMI. 

4) After step d) the terminal shall have taken action to prevent storage of the extended BCD number, e.g. by giving 
an indication to the user or not allowing to enter the extended number. EFexti shall have not been updated and 
the extension record identifier of the entry "Contact007" shall remain as "FF". 

5) After step e) records of EFadn and EFexti which were used to store the data for the phonebook entry 
"ContactOOl" shall be empty, i.e. the EFadn record shall be "FF. . . FF" and the EFexti record shall be "OOFF. . . 
FF." 

6) After step f) the record of EFexti which was used to store the BCD number extension "777888999" shall be 
empty and the record used for storing the entry with the alpha identifier "Contact002" of EFadn shall contain the 
BCD number "22446622446600" and the extension record identifier "FF". 

7) After step g) a record of EFadn shall contain "NewContact" as alpha identifier, "12345678901234567890" as 
BCD number and shall use an extension record identifier unequal to "FF". 

The EFexti record which was indicated in the EFadn record used in this case shall contain "Additional data" as 
record type, "12345678901234567890" as BCD number and an extension record identifier unequal to "FF", 
while the EFexti record used to continue the chain inside EFexti shall contain "Additional data" as record type, 
"123456789012" as BCD number and "FF" as extension record identifier. 

If the maximum number of BCD digits supported for global phonebook updating is less than the requested input 
BCD number, then EFadn and EFexti shall contain the BCD number as entered on the MMI. 

8) After step h) the record of EFadn which was used to store the data for "Contact003" and the related records of 
EFexti shall be empty. 

8.1.4 Phonebook selection 

8.1 .4.1 Definition and applicability 

The UICC may contain a global phonebook, or application specific phonebooks, or both in parallel. When both 
phonebook types co-exist, they are independent and no data is shared. In this case, it shall be possible for the user to 
select which phonebook the user would like to access. 

8.1 .4.2 Conformance requirement 

The terminal shall support the global and the application specific phonebooks as defined in TS 31.102 [4], subclause 
4.4.2. 

Reference: 

- TS 31.102 [4], subclause 4.4.2. 

8.1.4.3 Test purpose 

1) To verify that the terminal offers a possibility to select which phonebook the user would like to select if both, 
the global and the local phonebook, co-exist. 

2) To verify that the data contained in the local phonebook can be read and updated correctly. 

3) To verify that the data contained in the global phonebook can be read and updated correctly. 



ETSI 



3GPP TS 31.121 version 10.2.1 Release 10 



207 



ETSI TS 131 121 VI 0.2.1 (2011-11) 



8.1.4.4 Method of test 
8.1 .4.4.1 Initial conditions 

The terminal is connected to the USIM Simulator. 
The default USIM is used with the following exceptions: 
The local and the global phonebook are both present. 
The local phonebook shall contain: 
EFpBR (Phonebook reference file) 

Logically: Only EFadn and EFexti are present in the local phonebook. 



EFadn (Abbreviated dialling numbers) 

Logically: 10 records, each record non-empty and unique. 

Record 4: 



Record 4: 

Coding: 
Hex 

Record 5: 



Record 5: 



Coding: 


B1 


B2 


B3 


B4 


B5 


B6 


Hex 


43 


6F 


6E 


74 


61 


63 




B34 


B35 


B36 


B37 


B38 


B39 




91 


21 


43 


FF 


FF 


FF 



The global phonebook shall contain: 
EFpBR (Phonebook reference file) 

Logically: Only EFadn is present in the global phonebook. 



BIO B11 ... B32 B33 
34 FF ... FF 03 



B7 B8 B9 BIO B1 1 ... B32 B33 
74 30 30 35 FF ... FF 03 

B46 
FF 



Length of alpha identifier: 
Alpha identifier: 
Length of BCD number: 
TON and NPL 
Dialled number: 
CCL 
Extl: 



32 characters; 
"Contact004"; 
"03"; 

Telephony and International; 

004; 

'FF'; 

'FF'. 



B1 


B2 


B3 


B4 


B5 


B6 


B7 


B8 


B9 


43 


6F 


6E 


74 


61 


63 


74 


30 


30 


B34 


B35 


B36 


B37 


B38 


B39 




B46 




91 


00 


F4 


FF 


FF 


FF 




FF 





Length of alpha identifier: 

Alpha identifier: 

Length of BCD number: 

TON and NPI: 

Dialled number: 

CCI: 

Extl: 



32 characters; 
"ContactOOS"; 
"03"; 

Telephony and International; 

1234; 

'FF'; 

None. 



EFadn (Abbreviated dialling numbers) 

Logically: 8 records, records 3 and 6 empty, each non-empty record unique. 
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Record 1: 



Length of alpha identifier: 32 characters; 



Alpha identifier: 
Length of BCD number: 
TON and NPL 
Dialled number: 
CCL 
Extl: 



"ContactOOl"; 
"03"; 

Telephony and International; 

001; 

'FF'; 

'FF'. 



Record 1: 



Coding: 


B1 


B2 


B3 


B4 


B5 


B6 


B7 


B8 


B9 


BIO 


B11 


B32 


Hex 


43 


6F 


6E 


74 


61 


63 


74 


30 


30 


31 


FF 


FF 




B34 


B35 


B36 


B37 


B38 


B39 




B46 












91 


00 


F1 


FF 


FF 


FF 




FF 











B33 
03 



Record 2: 



Length of alpha identifier: 32 characters; 



Alpha identifier: 
Length of BCD number: 
TON and NPL 
Dialled number: 
CCL 
Extl: 



"Contact002"; 
"03"; 

Telephony and International; 

002; 

'FF'; 

'FF'. 



Record 2: 



Coding: 


B1 


B2 


B3 


B4 


B5 


B6 


B7 


B8 


B9 


BIO 


B11 


B32 


Hex 


43 


6F 


6E 


74 


61 


63 


74 


30 


30 


32 


FF 


FF 




B34 


B35 


B36 


B37 


B38 


B39 




B46 












91 


00 


F2 


FF 


FF 


FF 




FF 











Record 4: 



Length of alpha identifier: 32 characters; 



Alpha identifier: 
Length of BCD number: 
TON and NPL 
Dialled number: 
CCL 
Extl: 



"Contact004"; 
"03"; 

Telephony and International; 

0041; 

'FF'; 

'FF'. 



Record 4: 



Coding: 


B1 


B2 


B3 


B4 


B5 


B6 


B7 


B8 


B9 


BIO 


B11 


B32 


Hex 


43 


6F 


6E 


74 


61 


63 


74 


30 


30 


34 


FF 


FF 




B34 


B35 


B36 


B37 


B38 


B39 




B46 












91 


00 


14 


FF 


FF 


FF 




FF 











B33 
03 



Record 5: 



Length of alpha identifier: 32 characters; 



Alpha identifier: 
Length of BCD number: 
TON and NPL 
Dialled number: 
CCL 
Extl: 



"Contact005"; 
"03"; 

Telephony and International; 

1234; 

'FF'; 

'FF'. 



Record 5: 
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Coding: 


B1 


B2 


B3 B4 


B5 


B6 


B7 


B8 


B9 


BIO 


B11 


B32 


B33 


Hex 


43 


6F 


6E 74 


61 


63 


74 


30 


30 


35 


FF 


FF 


03 




B34 


B35 


B36 B37 


B38 


B39 




B46 














91 


21 


43 FF 


FF 


FF 




FF 












Record 7: 




Length of alpha identifier: 


32 characters; 


















Alpha identifier: 




"Contact007"; 


















Length of BCD number: 


"03"; 




















TON and NPL 




Telephony and 


International; 














Dialled number: 




007; 




















CCL 






'FF'; 




















Extl: 






'FF'. 
















Record 7: 


























Coding: 


B1 


B2 


B3 B4 


B5 


B6 


B7 


B8 


B9 


BIO 


B11 


B32 


B33 


Hex 


43 


6F 


6E 74 


61 


63 


74 


30 


30 


37 


FF 


FF 


03 




B34 


B35 


B36 B37 


B38 


B39 




B46 














91 


00 


F7 FF 


FF 


FF 




FF 












Kecora o: 




Length of alpha identifier: 


32 characters; 


















Alpha identifier: 




"ContactOOS"; 


















Length of BCD number: 


"03"; 




















TON and NPL 




Telephony and 


International; 














Dialled number: 




008; 




















CCL 






'FF'; 




















ExtL 






'FF'. 
















Record 8: 


























Coding: 


B1 


B2 


B3 B4 


B5 


B6 


B7 


B8 


B9 


BIO 


B11 


B32 


B33 


Hex 


43 


6F 


6E 74 


61 


63 


74 


30 


30 


38 


FF 


FF 


03 




B34 


B35 


B36 B37 


B38 


B39 




B46 














91 


00 


F8 FF 


FF 


FF 




FF 













8.1.4.4.2 Procedure 

a) The terminal is switched on and the USIM application shall be activated. 

b) The user shall use an MMI dependent procedure to select the global phonebook. 

c) The global phonebook record with the alpha identifier "ContactOOS" and the associated dialling number shall 
be read by the user. 

d) The dialling number of the global phonebook record with the alpha identifier "ContactOOS" shall be set to 
"+1 122330". 

e) A new entry with the values "Contact006" as alpha identifier and "+9876S43210" as associated dialling 
number shall be added to the global phonebook. 

f) The user shall use an MMI dependent procedure to select the local phonebook. 

g) The local phonebook record with the alpha identifier "ContactOOS" and the associated dialling number shall 
be read by the user. 

h) The dialling number of the local phonebook record with the alpha identifier "ContactOOS" shall be set to 
"+1122334S". 

i) The user shall try to add a new entry with the values "ContactOO?" as alpha identifier and "+007" as 
associated dialling number to the local phonebook. 
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j) The user shall delete the entry "Contact004" from the local phonebook. 

k) The user shall add a new entry with the values "ContactOOT" as alpha identifier and "+007" as associated 
dialling number to the local phonebook. 

1) The user shall use an MMI dependent procedure to select the global phonebook. 

m) The user shall delete the entry "ContactOOT" from the global phonebook. 

n) The terminal is switched off. 

8.1.4.5 Acceptance criteria 

1) After step a) the terminal shall have activated the USIM application, shall have read the status of the local 
Phonebook in EFust- 

2) After step b) the terminal shall have selected the global phonebook and shall have read EFpbr in the global 
phonebook. 

3) After step c) the terminal shall have read the global phonebook record which is used to store the enrty 
"ContactOOS" and shall have presented the alpha identifier "ContactOOS" and the diaUing number "+1234" to 
the user. 

4) After step d) EFadn in the global phonebook shall contain a record with the alpha identifier "ContactOOS" 
with the new dialling number "+1 122330" and the terminal shall have given an indication to the user that the 
phonebook update has been performed successfully. 

5) After step e) a new record shall have been added to EFadn in the global phonebook with the alpha identifier 
"Contact006" and the dialling number string "+9876543210". 

6) After step f) the terminal shall have selected the local phonebook and shall have read EFpbr in the local 
phonebook. 

7) After step g) the terminal shall have read the local phonebook record which is used to store the entry 
"ContactOOS" and shall have presented the alpha identifier "ContactOOS" and the diaUing number "+1234" to 
the user. 

8) After step h) EFadn in the local phonebook shall contain a record with the alpha identifier "ConatctOOS" and 
with new dialling number "+1 1223345" and the terminal shall have given an indication to the user that the 
phonebook update has been performed successfully. 

9) After step i) the terminal shall have given an indication that update of the local phonebook can't be 
performed. EFadn shall have not been updated. 

10) After step j) the local phonebook record which was used to store the entry "Contact004" shall be empty and 
the terminal shall have indicated that the deletion of the phonebook entry was performed successfully. 

11) After step k) a new record shall have been added to EFadn in the local phonebook with the alpha identifier 
"ContactOOV" and the dialling number string "+007" 

12) After step 1) the terminal shall have selected the global phonebook and shall have read EFpbr in the global 
phonebook. 

13) After step m) the global phonebook record which was used to store the entry "ContactOOV" shall be empty 
and the terminal shall have indicated that the deletion of the phonebook entry was performed successfully. 

8.1 .5 Local Phonebook handling 
8.1 .5.1 Definition and applicability 

The UICC may contain a global phonebook, or application specific phonebooks, or both in parallel. 
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8.1 .5.2 Conformance requirement 

The terminal shall support the local phonebook as defined in TS 31.102 [4], subclause 4.4.2. 
Reference: 

- TS 3 1 . 1 02 [4] , subclause 4.4.2. 

8.1.5.3 Test purpose 

1) To verify that the terminal supports the local phonebook without existence of the global phonebook. 

2) To verify that the data contained in the local phonebook can be read and updated correctly. 

8.1.5.4 Method of test 
8.1 .5.4.1 Initial conditions 

The terminal is connected to the USIM Simulator. 

The default USIM is used with the following exceptions: 

The local phonebook is present, the global phonebook is not present. 

The local phonebook shall contain: 

EFpBR (Phonebook reference file) 

Logically: Only EFadn and EFexti are present in the local phonebook. 

EFadn (Abbreviated dialling numbers) 

Logically: 10 records, each record non-empty and unique. 



Record 4: 



Length of alpha identifier: 32 characters; 



Alpha identifier: 
Length of BCD number: 
TON and NPL 
Dialled number: 
CCL 
Extl: 



"Contact004"; 
"03"; 

Telephony and International; 

004; 

'FF'; 

'FF'. 



Record 4: 



Coding: 


B1 


B2 


B3 


B4 


B5 


B6 


B7 


B8 


B9 


BIO 


B11 


B32 


B33 


Hex 


43 


6F 


6E 


74 


61 


63 


74 


30 


30 


34 


FF 


FF 


03 




B34 


B35 


B36 


B37 


B38 


B39 




B46 














91 


00 


F4 


FF 


FF 


FF 




FF 













Record 5: Length of alpha identifier: 32 characters; 

Alpha identifier: 
Length of BCD number: 
TON and NPL 
Dialled number: 
CCL 
Extl: 



"ContactOOS"; 
"03"; 

Telephony and International; 
1234; 
'FF'; 
'FF'. 



Record 5: 
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Coding: 


B1 


B2 


B3 


B4 


B5 


B6 


B7 


B8 


B9 


BIO 


B11 


B32 


B33 


Hex 


43 


6F 


6E 


74 


61 


63 


74 


30 


30 


35 


FF 


FF 


03 




B34 


B35 


B36 


B37 


B38 


B39 




B46 














91 


21 


43 


FF 


FF 


FF 




FF 













8.1.5.4.2 Procedure 

a) The terminal is switched on and the USIM apphcation shall be activated. 

b) The user shall use an MMI dependent procedure to select the phonebook on the USIM (local phonebook). 

c) The local phonebook record with the alpha identifier "ContactOOS" and the associated dialling number shall be 
read by the user. 

d) The dialling number of the local phonebook record with the alpha identifier "ContactOOS" shall be set to 
"+1 1223345" and the alpha identifier shall be changed to "Contact8901234567890123456789012". 

e) The user shall try to add a new entry with the values "Contact007" as alpha identifier and "+007" as associated 
dialling number to the local phonebook. 

f) The user shall delete the entry "Contact004" from the local phonebook. 

g) The user shall add a new entry with the values "Contact007" as alpha identifier and "+007" as associated dialling 
number to the local phonebook. 

h) The terminal is switched off. 

8.1.5.5 Acceptance criteria 

1) After step a) the terminal shall have activated the USIM application, shall have read the status of the local 
Phonebook in EFust- 

2) After step b) the terminal shall have selected the local phonebook and shall have read EFpbr in the local 
phonebook. 

3) After step c) the terminal shall have read the local phonebook record which is used to store the entry 
"Contact005" and shall have presented the alpha identifier "Contact005" and the dialling number "+1234" to the 
user. 

4) After step d) EFadn in the local phonebook shall contain a record with the new alpha identifier 
"Contact8901234567890123456789012" and the dialling number "+1 1223345" and the terminal shall have given 
an indication to the user that the phonebook update has been performed successfully. 

5) After step e) the terminal shall have given an indication that update of the local phonebook can't be performed. 
EFadn shall have not been updated. 

6) After step f) the local phonebook record which was used to store the entry "Contact004" in the local phonebook 
shall be empty and the terminal shall have indicated that the deletion of the phonebook entry was performed 
successfully. 

7) After step g) a new record shall have been added to EFadn in the local phonebook with the alpha identifier 
"Contact007" and the dialling number string "+007" 
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8.2 Short message handling report 

8.2.1 Correct storage of a SM on the USIM 

8.2.1 .1 Definition and applicability 

Once a SMS is received by the UE, the Terminal shall store the SM on the USIM, if this is indicated by the class 2 of 
the SMS (USIM specific SM). For this it is assumed, that at least one relevant SMS field are available on the USIM and 
they are indicated as empty. 

8.2.1 .2 Conformance requirement 

The received class 2 SMS shall be stored on the USIM in EFsms- The status of a received SMS, which has not been read 
yet, shall be set to "3" (SMS to be read). 

- TS 23.038 [3], clause 4. 

- TS 23.040 [13], subclause 10.1, operation 6; 

- TS 24.011, subclauses 8.2.2, 8.2.3 and 8.2.5.4, Table 8.4 (part 2) 

- TS 31.102 [4], subclauses 4.2.25. 

8.2.1 .3 Test purpose 

1) To verify that the Terminal stored correctly the class 2 SMS on the USIM. 

2) To verify that the Terminal sets the status of a received, and not yet read SMS to "3" (SMS to be read) 

8.2.1.4 Method of test 



8.2.1 .4.1 Initial conditions 

The default UICC is used with the following exceptions: 

1) EFusT (USIM Service Table) 

Logically: Local Phone Book available 

User controlled PLMN selector available 
Fixed dialling numbers available 
Barred dialling numbers available 
The GSM Access available 

The Group Identifier level 1 and level 2 not available 
SMS available 
SMS Status available 

Service n 33 (Packed Switched Domain) shall be set to T 
Enabled Services Table available 



Byte: 


B1 


B2 


B3 


B4 


B5 


Binary 


xx1 X xx1 1 


xxxx X1 1 X 


xxxx 1 xOO 


xxxx X1 XX 


xxxx XX 1 1 



The coding of EFust shall conform with the capabilities of the USIM used. 
2) EFsMs (Short Message Service) and EFsmss (SMS Status) as defined in 8.2.4.4.1. 
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The USS (in case of a Terminal accessing UTRAN)/SS (in case of a Terminal accessing a GERAN) transmits on the 
BCCH, with the following network parameters: 

- Attach/detach: disabled. 

- LAI (MCC/MNC/LAC): 246/081/0001. 

- Access control: unrestricted. 

The USS/SS transmits the class 2 short message with the parameters as defined in 8.2.4.4.1. 
User Equipment: 

The UE is connected to the USIM-Simulator and the USS/SS. 

8.2.1.4.2 Procedure 

CS related sequence for UTRAN/GERAN 

Perform the "CS related procedure" and continue with "Generic Procedure 1" as defined clause 8.2.4.4.2 as test 
"8.2.1" with the following parameters: 

• AppHcable Network Simulator (NWS): USS (UMTS System Simulator or System Simulator) 

• CS is used to send and receive short messages 

• ME supports UTRAN or GERAN 
CS related procedure: 

a) The ME is switched on and will perform the Profile Download, USIM initialization and network registration. 

b) Continue with step c) of the Generic Procedure 1 as defined in 8.2.4.4.2. 

8.2.1 .5 Acceptance criteria 

1) After step c) the record of the USIM EFsms which was empty, shall contain the values as defined in 8.2.4.5 

8.2.2 Correct reading of a SM on the USIM 

8.2.2.1 Definition and applicability 

A SM which is stored but not yet read, is indicated as Status "3" (SMS to be read ) on EFsms- The Terminal may 
indicate the user this status. After the SMS is read by the user, the status of the SMS shall be changed to "1" (SMS 
read). 

8.2.2.2 Conformance requirement 

A received SM was stored on the USIM in EFsms- At the time the SMS is read by the user, the status of a received SMS, 
shall be changed to "1" (SMS read). 

- TS 23.038 [3], clause 4. 

- TS 23.040 [13]; 

- TS 31.102 [4], subclauses 4.2.25 and 4.2.28. 

8.2.2.3 Test purpose 

1) To verify that the Terminal read correctly the SMS on the USIM. 

2) To verify that the Terminal changes the status of a read SMS to "1" (SMS read). 
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8.2.2.4 Method of test 
8.2.2.4.1 Initial conditions 

The default UICC is used with the following exception: 
EFusT (USIM Service Table) 

Logically: Local Phone Book available 

User controlled PLMN selector available 
Fixed dialling numbers available 
Barred dialling numbers available 
The GSM Access available 

The Group Identifier level 1 and level 2 not available 
SMS available 
SMS Status available 

Service n 33 (Packed Switched Domain) shall be set to T 
Enabled Services Table available 

Coding: B1 B2 B3 B4 B5 

binary xx1 x xx1 1 xxxx X1 1 x xxxx 1 xOO xxxx x1 xx xxxx xx1 1 

The coding of EFust shall conform with the capabilities of the USIM used. 
EFsMss (SMS Status) 

Logically: Last used TP-MR not set. 

Memory capacity available (flag unset bl="r'). 

Coding: B1 B2 
Hex FF FF 

EFsMs (Short Message Service) 

Logically: Status byte set to SMS to be read. 

A chosen test is written in the text body of the EFsms- 

Record 1: 

Coding: B1 B2 B3 B4 B5 B6 B7 B8 B9 B10 B11 B12 ... B176 
Hex 03 XX XX xx xx xx xx xx xx xx xx xx ... xx 

NOTE: "xx" shall be the appropriate text using the SMS default 7-bit coded alphabet as defined in TS 23.038 [3] 
which represents the stored SMS. 

At least 9 records. 

Logically: Status byte set to empty 

no text is written (Remainder Bytes set to "FF"). 

Record: 

Coding: B1 B2 B3 B4 B5 B6 B7 B8 B9 B10 B11 B12 ... B176 
Hex 00 FF FF FF FF FF FF FF FF FF FF FF ... FF 

A USS (in case of a Terminal accessing UTRAN) or a SS (in case of a Terminal accessing GERAN) is only needed to 
bring the UE into a defined idle mode. The USS/SS transmits on the BCCH: 

- Attach/detach: disabled. 

- LAI (MCC/MNC/LAC): 246/081/0001. 
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- Access control: unrestricted. 
User Equipment: 

The UE is in MM-state "idle, updated". 

8.2.2.4.2 Procedure 

a) After the UE has brought in idle state, the SMS shall be read. 

b) The UE is powered off. 

8.2.2.5 Acceptance criteria 

1) After a) the correct text of the SMS shall be read from the UE display. 

2) After step b) the EFsms record 1 shall contains the following values: 

Logically: Status byte set to SMS read. 

The entire content of the SMS shall be unchanged. 

Record 1: 

Coding: B1 B2 B3 B4 B5 B6 B7 B8 B9 B10 B11 B12 ... B176 
Hex 01 XX XX Xx xx xx xx xx xx xx xx xx ... xx 

NOTE: "xx" shall be the appropriate text using the SMS default 7-bit coded alphabet as defined in TS 23.038 [3] 
which represents the stored SMS. 

8.2.3 SM memory capacity exceeded handling 

8.2.3.1 Definition and applicability 

Once a SMS is received by the UE, the Terminal shall store the SM on the USIM, if this is indicated by the class 2 of 
the SMS (USIM specific SM). For this it is assumed, that at least one relevant SMS field are available on the USIM and 
they are indicated as empty. If all SMS data field are full and furthermore all memory capacity reserved for SMS inside 
the ME is filled up to maximum and a SM was rejected, then this shall be indicated in the SMS Status file. 

8.2.3.2 Conformance requirement 

The received class 2 SMS shall be stored on the USIM in EFsms- The status of a received SMS, which has not been read 
yet, shall be set to "3" (SMS to be read). If the terminal notifies the network that the terminal has been unable to accept 
a short message because its memory capacity has been exceeded, then the ME shall set the Memory Capacity Exceeded 
Notification Flag in the EFsmss- 

- TS 23.038 [3], clause 4. 

- TS 23.040 [13], subclause 10.1, operation 6; 

- TS 24.011, subclauses 8.2.2, 8.2.3 and 8.2.5.4, Table 8.4 (part 2) 

- TS 31.102 [4], subclauses 4.2.25 and 4.2.28. 

8.2.3.3 Test purpose 

1) To verify that the Terminal stored correctly the class 2 SMS on the USIM. 

2) To verify that the Terminal sets the status of a received, and not yet read SMS to "3" (SMS to be read). 

3) To verify that the Terminal sets the memory full flag in EFsmss if the terminal notifies the network that the 
terminal has been unable to accept a short message because its memory capacity has been exceeded. 
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8.2.3.4 Method of test 
8.2.3.4.1 Initial conditions 

The default UICC is used with the following exception: 
EFusT (USIM Service Table) 

Logically: Local Phone Book available 

User controlled PLMN selector available 
Fixed dialling numbers available 
Barred dialling numbers available 
The GSM Access available 

The Group Identifier level 1 and level 2 not available 
SMS available 
SMS Status available 

Service n 33 (Packed Switched Domain) shall be set to T 
Enabled Services Table available 

Coding: B1 B2 B3 B4 B5 

binary xx1 x xx1 1 xxxx X1 1 x xxxx 1 xOO xxxx x1 xx xxxx xx1 1 



The coding of EFust shall conform with the capabilities of the USIM used. 

EFsMs (Short Message Service) 

At least 10 records. 

Record 1 shall be empty. 

Logically: Status byte set to empty. 

Record 1: 

Coding: B1 B2 B3 B4 B5 B6 B7 B8 B9 B10 B11 B12 ... B176 
Hex 00 FF FF FF FF FF FF FF FF FF FF FF ... FF 



All other Record shall be full. 

Logically: Status byte set to SMS read. 

The text body of the record shall be filled with any appropriate text. 

Records: 

Coding: B1 B2 B3 B4 B5 B6 B7 B8 B9 B10 B11 B12 ... B176 
Hex 01 XX XX XX xx xx xx xx xx xx xx xx ... xx 



NOTE: "xx" shall be the appropriate text using the SMS default 7-bit coded alphabet as defined in TS 23.038 [3] 
which represents the received SMS. 

EFsMss (SMS Status) 

Logically: Last used TP-MR not defined. 

Memory capacity available (flag unset b !="!"). 



Coding: B1 B2 
Hex FF FF 
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The USS (in case of a Terminal accessing UTRAN) /SS (in case of a Terminal accessing a GERAN) transmits on the 
BCCH, with the following network parameters: 

- Attach/detach: disabled. 

- LAI (MCC/MNC/LAC): 246/081/0001. 

- Access control: unrestricted. 

The USS/ SS transmits the short messages with the following parameters: 
Logically: 

Class 2 SM:TS-Service Centre Address: 
Bit 8: 1 
Type-Of-Number: International number 

Numbering-Plan-Identification: ISDN/telephony numbering plan 
Address value: 1 12233445566 

SMS TPDU: 

TP-Message-Type-Indicator: SMS-DELIVER (in the direction SC to MS) 
TP-More-Messages-to-Send: No more messages are waiting for the MS in this SC 
TP-Reply-Path: TP-Reply-Path parameter is not set in this SMS-DELIVER 

TP-User-Data-Header-Indicator: The TP-UD field contains only the short message 
TP-Status-Report-Indication: A status report shall be returned to the SME 
Bits 4-3: 00 
TP-Originating-Address: 

1 

International number 
ISDN/telephony numbering plan 
012344556677 
No interworking, but SME-to-SME protocol 



Bit 8: 

Type-Of-Number: 

Numbering-Plan-Identification: 

Address value: 
TP-Protocol-Identifier: 
TP-Data-Coding-Scheme: 

Bits 8-7: 

Bit 6: 

Bit 5: 

Bits 4-3: 

Bits 2-1: 



General Data Coding 

Text is uncompressed 

Bits 2-1 have a message class meaning 

GSM 7 bit default alphabet 

Class 2: (U)SIM specific message 



TP-Service-Centre-Time-Stamp: 02-03-04 09:13:06 GMT + 1 

TP-User-Data-Length: 1 60 

TP-User-Data: 

"Once a SMS is received by the UE, the Terminal shall store the SMS on the USIM, if this is indicated by the 
class 2 of the SMS (USIM specific SMS). For this..." 
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Class 1 SM: 

The same content as for the Class 2 SMS except : 
SMS TPDU: 

TP-More-Messages-to-Send: 
TP-Data-Coding-Scheme: 

Bits 2-1: 
TP-Service-Centre-Time-Stamp: 
User Equipment: 



More messages are waiting for the MS in this SC 

Class 1: default meaning: ME-specific 

Always set to current time of the system simulator 



The UE is in MM-state "idle, updated". If there is ME storage capacity available the storage for SMS inside the ME 
shall be able to allow for at least one more mobile terminated (e.g. Class 1) SM. 



8.2.3.4.2 



Procedure 



a) After the UE is set to idle mode, the defined class 2 SM defined in 8.2.1.4.1 with 160 characters shall be sent to 
the UE. 

b) After the UE has indicated that a SM was received, the SM shall not be read. 

c) The USS starts sending Class 1 SMs as defined in 8.2.1.4.1 until the UE sends an RP-ERROR message with 
cause "Memory capacity exceeded". 

d) The UE is powered off. 

8.2.3.5 Acceptance criteria 

1) After step b) the record of the EFsms which was empty, shall contain the following values: 

Logically: Status byte set to SMS to be read 

The text of the received SMS shall be present in the record. 

Record 1: 
Logically: 
Status: 

RFU bits 8-6: 
Status: 

TS-Service Centre Address: 
Bit 8: 

Type-Of-Number: 
Numbering-Plan-Identification: 
Address value: 
SMS TPDU: 

TP-Message-Type-Indicator: 
TP-More-Messages-to-Send: 
TP-Reply-Path: 



000 

Used space, message received by UE from network, message to be read 
1 

International number 
ISDN/telephony numbering plan 
112233445566 

SMS-DELIVER (in the direction SC to UE) 

No more messages are waiting for the UE in this SC 

TP-Reply-Path parameter is not set in this SMS-DELIVER 



TP-User-Data-Header-Indicator: The TP-UD field contains only the short message 
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TP-Status-Report-Indication: 
Bits 4-3: 

TP-Originating- Address: 
Bit 8: 

Type-Of-Number: 

Numbering-Plan-Identification: 

Address value: 
TP-Protocol-Identifier: 
TP-Data-Coding-Scheme: 

Bits 8-7: 

Bit 6: 

Bit 5: 

Bits 4-3: 

Bits 2-1: 



A status report shall be returned to the SME 
00 

1 

International number 
ISDN/telephony numbering plan 
012344556677 
No interworking, but SME-to-SME protocol 

General Data Coding 

Text is uncompressed 

Bits 2-1 have a message class meaning 

GSM 7 bit default alphabet 

Class 2: (U)SIM specific message 



TP-Service-Centre-Time-Stamp: 02-03-04 09:13:06 GMT + 1 

TP-User-Data-Length: 1 60 

TP-User-Data: 

"Once a SMS is received by the UE, the Terminal shall store the SMS on the USIM, if this is indicated by the 
class 2 of the SMS (USIM specific SMS). For this ..." 



Coding: 
Hex 



03 


07 


91 


11 


22 


33 


44 


55 


66 


24 


OC 


91 


10 


32 


44 


55 


66 


77 


00 


12 


20 


30 


40 


90 


31 


60 


40 


AO 


4F 


F7 


B8 


OC 


OA 


83 


A6 


CD 


29 


28 


3D 


07 


C9 


CB 


E3 


72 


DA 


5E 


26 


83 


C4 


79 


10 


ID 


5D 


06 


55 


8B 


2C 


10 


ID 


5D 


06 


51 


CB 


F2 


76 


DA 


ID 


66 


83 


E6 


E8 


30 


9B 


OD 


9A 


D3 


DF 


F2 


32 


88 


8E 


2E 


83 


A6 


CD 


29 


E8 


ED 


06 


D1 


D1 


65 


50 


75 


9A 


6C 


B2 


40 


69 


33 


88 


8E 


4E 


CP 


41 


E9 


39 


28 


ED 


26 


A7 


C7 


61 


7A 


99 


OC 


12 


E7 


41 


74 


74 


19 


34 


66 


87 


E7 


73 


90 


OC 


F4 


36 


83 


E8 


E8 


32 


68 


DA 


9C 


82 


50 


D5 


69 


B2 


09 


9A 


C3 


CB 


E3 


B4 


39 


3D 


06 


4D 


9B 


D3 


94 


OB 


64 


7C 


CB 


41 


74 


74 


7A 


OE 


72 


B9 


5C 



















7) 

EFsMss (SMS Status) 

Logically: 



After step d) the Memory Capacity Exceeded Notification Flag in the EFsmss shall be set to 
exceeded. 



Coding: 
Hex 



B1 

XX 



Last used TP-MR shall be set to any appropriate value. 
Memory capacity exceeded (flag set bl="0"). 



B2 
FE 
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8.2.4 Correct storage of an SM on the UlCC 

8.2.4.1 Definition and applicability 

For IMS: When a SIP MESSAGE request including a short message in the "vnd.3gpp.sms" payload is deUvered and the 
extracted RP-DATA payload contains a Class 2 SM (USIM specific SM) the terminal shall store the SM on the USIM 
or ISIM. For this it is assumed, that at least one relevant SMS field are available on the USIM or ISIM and they are 
indicated as empty. 

That the UE correctly implemented the role of an SMS-over-IP receiver is tested in clause 18.2 of TS 34.229-1 [33]. 

8.2.4.2 Conformance requirement 

As TS 3 1.1 03 [x] and TS 3 1.1 02 [4] do not indicate in which of both applications a SM received via IMS shall be stored, 
the received Class 2 SM received via IMS shall be stored in EFsms either on the USIM or on the ISIM. The status of a 
received SMS, which has not been read yet, shall be set to "3" (SMS to be read). 

- TS 23.038 [3], clause 4. 

- TS 23.040 [13], subclause 10.1, operation 6; 

- TS 24.011, subclauses 7.3.1.1, 8.2.2, 8.2.3 and 8.2.5.4, Table 8.4 (part 2) 

- TS 31.102 [4], subclauses 4.2.25, 

- TS 31.103 [32], subclauses 4.2.12, 

- TS 34.229 [33], Annexes C.2, C.18 and 18.2. 



8.2.4.3 Test purpose 

1) To verify that the Terminal stored correctly the class 2 SMS on the USIM or the ISIM. 

2) To verify that the Terminal sets the status of a received, and not yet read SMS to "3" (SMS to be read). 



8.2.4.4 Method of test 
8.2.4.4.1 Initial conditions 

The E-UTRAN/EPC ISIM-UICC is used with the following exception: 

Logically: Local Phone Book available 

User controlled PLMN selector available 
Fixed dialling numbers available 
Barred dialling numbers available 
The GSM Access available 

The Group Identifier level 1 and level 2 not available 
SMS available 
SMS Status available 

Service n 33 (Packed Switched Domain) shall be set to T 
Enabled Services Table available 



Byte: 


B1 


B2 


B3 


B4 


B5 


Binary 


xx1 x xx1 1 


xxxx X1 1 X 


xxxx 1 xOO 


xxxx X1 XX 


xxxx xx1 1 



The coding of EFust shall conform with the capabilities of the USIM used. 
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EFsMs (Short Message Service) - For USIM and ISIM 

At least 10 records. 

Record 1 shall be empty. 

Logically: Status byte set to empty. 

Record 1: 



Coding: 
Hex 



B1 
00 



B2 
FF 



B3 
FF 



84 
FF 



B5 
FF 



B6 
FF 



87 
FF 



B8 
FF 



B9 
FF 



B10 
FF 



B11 
FF 



B12 
FF 



B176 
FF 



All other Record shall be full. 

Logically: Status byte set to SMS read. 

The text body of the record shall be filled with any appropriate text. 



Records: 

Coding: 
Hex 



B1 
01 



B2 

XX 



B3 

XX 



B4 

XX 



B5 

XX 



B6 

XX 



B7 

XX 



B8 

XX 



B9 

XX 



B10 

XX 



B11 

XX 



B12 

XX 



B176 

XX 



NOTE: "xx" shall be the appropriate text using the SMS default 7-bit coded alphabet as defined in TS 23.038 [3] 
which represents the received SMS. 

EFsMss (SMS Status) - For USIM and ISIM 



Logically: 



Coding: 
Hex 



B1 
FF 



Last used TP-MR not defined. 

Memory capacity available (flag unset bl="r'). 



B2 
FF 



The NWS transmits on the BCCH, with the following network parameters: 

- Attach/detach: disabled. 

- USS LAI (MCC/MNC/LAC): 246/081/0001 (For UTRAN testing only) 

- E-USS TAI (MCC/MNC/TAC) : 246/081/0001 (For E-UTRAN testing only) 

- Access control: unrestricted. 

The NWS transmits the short messages with the following parameters: 
Logically: 

Class 2 SM:TS-Service Centre Address: 



Bit 8: 

Type-Of-Number: 



1 



International number 



Numbering-Plan-Identification: ISDN/telephony numbering plan 



Address value: 
SMS TPDU: 

TP-Message-Type-Indicator: 
TP-More-Messages-to-Send: 
TP-Reply-Path: 



112233445566 

SMS-DELIVER (in the direction SC to MS) 

No more messages are waiting for the MS in this SC 

TP-Reply-Path parameter is not set in this SMS-DELIVER 



TP-User-Data-Header-Indicator: The TP-UD field contains only the short message 
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TP-Status-Report-Indication: 
Bits 4-3: 

TP-Originating- Address: 
Bit 8: 

Type-Of-Number: 

Numbering-Plan-Identification: 

Address value: 
TP-Protocol-Identifier: 
TP-Data-Coding-Scheme: 

Bits 8-7: 

Bit 6: 

Bit 5: 

Bits 4-3: 



A status report shall be returned to the SME 
00 

1 

International number 
ISDN/telephony numbering plan 
012344556677 
No interworking, but SME-to-SME protocol 

General Data Coding 

Text is uncompressed 

Bits 2-1 have a message class meaning 

GSM 7 bit default alphabet 



a) The ME activates the required bearer, discovers the P-CSCF, and registers with the values from the ISIM with 
GeitbeiG^oeeufdkog (see Note 2). 

b) Continue with step c) in the Generic Procedure 1 . 



Bits 2-1: Class 2: (U)SIM specific message 

TP-Service-Centre-Time-Stamp: 02-03-04 09:13:06 GMT + 1 
TP-User-Data-Length: 1 60 

TP-User-Data: 

"Once a SMS is received by the UE, the Terminal shall store the SMS on the USIM, if this is indicated by the 
class 2 of the SMS (USIM specific SMS). For this..." 



8.2.4.4.2 Procedure 
Sequence A for IMS on UTRAN 
Sequence B for IMS on E-UTRAN 

a) The ME activates the required bearer, discovers the P-CSCF, and registers with the values from the ISIM with 
the IMS services (see Note 3). 

b) Continue with step c) in the Generic Procedure 1 . 

c) After the UE is set to idle mode, the defined class 2 SM defined in 8.2.1.4.1 with 160 characters shall be sent to 
the UE (see Note 1) as specified in clause 18.2 of TS 34.229-1 [33] and use the SM payload defined in 8.2.1.4.1 
in the Message-body of MESSAGE defined in clause A.7.1 in TS 34.229-1 [33]. 

d) After the UE has indicated that a SM was received, the SM shall not be read. 

e) The UE is powered off. 
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Note 1 : In case of IMS the Short Message is contained in the message body of the SIP MESSAGE. 

Note 2: For E-UTRAN: The EPS bearer context activation according to the procedures defined in TS 34.229-1 [33], 

Annex C.2 and C.18 is performed. 
Note 3: For UTRAN: For SMS-over-IP a PDP context activation according to the procedures defined in TS 34.229-1 

[33], Annex C.2 and C.17 is performed. 



8.2.4.5 



Acceptance criteria 



1) After step d) the record of the EFsms (on either the ISIM or USIM) which was empty, shall contain the following 
values: 

Logically: Status byte set to SMS to be read 

The text of the received SMS shall be present in the record. 

Record 1: 
Logically: 
Status: 

RFU bits 8-6: 
Status: 

TS-Service Centre Address: 
Bit 8: 

Type-Of-Number: 



000 

Used space, message received by UE from network, message to be read 



International number 



Numbering-Plan-Identification: ISDN/telephony numbering plan 
Address value: 1 12233445566 

SMS TPDU: 

TP-Message-Type-Indicator: SMS-DELIVER (in the direction SC to UE) 
TP-More-Messages-to-Send: No more messages are waiting for the UE in this SC 
TP-Reply-Path: TP-Reply-Path parameter is not set in this SMS-DELIVER 

TP-User-Data-Header-Indicator: The TP-UD field contains only the short message 
TP-Status-Report-Indication: A status report shall be returned to the SME 
Bits 4-3: 00 
TP-Originating- Address: 
Bit 8: 

Type-Of-Number: 

Numbering-Plan-Identification: 

Address value: 
TP-Protocol-Identifier: 
TP-Data-Coding-Scheme: 

Bits 8-7: 

Bit 6: 

Bit 5: 



1 

International number 
ISDN/telephony numbering plan 
012344556677 
No interworking, but SME-to-SME protocol 

General Data Coding 
Text is uncompressed 
Bits 2-1 have a message class meaning 
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Bits 4-3 : GSM 7 bit default alphabet 

Bits 2-1: Class 2: (U)SIM specific message 

TP-Service-Centre-Time-Stamp: 02-03-04 09:13:06 GMT + 1 
TP-User-Data-Length: 1 60 

TP-User-Data: 

"Once a SMS is received by the UE, the Terminal shall store the SMS on the USIM, if this is indicated by the 
class 2 of the SMS (USIM specific SMS). For this ..." 

Coding: 



03 


07 


91 


11 


22 


33 


44 


55 


66 


24 


OC 


91 


10 


32 


44 


55 


66 


77 


00 


12 


20 


30 


40 


90 


31 


60 


40 


AO 


4F 


F7 


B8 


OC 


OA 


83 


A6 


CD 


29 


28 


3D 


07 


C9 


CB 


E3 


72 


DA 


5E 


26 


83 


C4 


79 


10 


ID 


5D 


06 


55 


8B 


2C 


10 


ID 


5D 


06 


51 


CB 


F2 


76 


DA 


ID 


66 


83 


E6 


E8 


30 


9B 


OD 


9A 


D3 


DF 


F2 


32 


88 


8E 


2E 


83 


A6 


CD 


29 


E8 


ED 


06 


D1 


D1 


65 


50 


75 


9A 


6C 


B2 


40 


69 


33 


88 


8E 


4E 


CF 


41 


E9 


39 


28 


ED 


26 


A7 


C7 


61 


7A 


99 


OC 


12 


E7 


41 


74 


74 


19 


34 


66 


87 


E7 


73 


90 


OC 


F4 


36 


83 


E8 


E8 


32 


68 


DA 


9C 


82 


50 


D5 


69 


B2 


09 


9A 


C3 


CB 


E3 


84 


39 


3D 


06 


4D 


9B 


D3 


94 


OB 


64 


7C 


CB 


41 


74 


74 


7A 


OE 


72 


B9 


5C 



















2) The UE shall pass the requirements which are verified in the MT SMS test case specified in clause 18.2 of TS 
34.229-1 [33]. 

8.2.5 Correct reading of a SM on the USIM if USIM and ISIM are present 

8.2.5.1 Definition and applicability 

A SM which is stored but not yet read, is indicated as Status "3" (SMS to be read) on EFsms- The Terminal may indicate 
the user this status. After the SMS is read by the user, the status of the SMS shall be changed to "1" (SMS read). This 
applies to short messages stored on the USIM and to short messages stored on the ISIM. 

8.2.5.2 Conformance requirement 

A received SM was stored in EFsms on the ISIM and another SM was stored in EFsms on the USIM. The user shall be 
able to read short messages stored on the USIM. At the time the SMS is read by the user, the status of a received SMS, 
shall be changed to "1" (SMS read). 

- TS 23.038 [3], clause 4. 

- TS 23.040 [13]; 

- TS 31.102 [4], subclauses 4.2.25 and 4.2.28, 

- TS 31.103 [32], subclauses 4.2.12 and 4.2.13. 

8.2.5.3 Test purpose 

1) To verify that the Terminal correctly reads the SMS on the USIM if the USIM and ISIM are both present. 

2) To verify that the Terminal changes the status of a read SMS to "1" (SMS read) of the message read from the 
USIM. 
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8.2.5.4 Method of test 
8.2.5.4.1 Initial conditions 

The E-UTRAN/EPC ISIM-UICC is used with the following exception: 
EFusT (USIM Service Table) 

As defined in in clause 4.5.2 with the expection that services n°10 (Short Message Storage) and n°ll (SMS Status 
Report) are available. 

EFsMss (SMS Status) on the USIM and on the ISIM 

Logically: Last used TP-MR not set. 

Memory capacity available (flag unset bl="l"). 



Byte: 


B1 


82 


Hex: 


FF 


FF 



EFsMs (Short Message Service) on the USIM 

Logically: Status byte set to SMS to be read. 

A chosen test is written in the text body of the EFsms- This content shall be different from the 
content stored in EFsms in the ISIM. 

Record 1: 



Coding: 


B1 


B2 


B3 


B4 


B5 


B6 


B7 


B8 


B9 


B10 


B11 


B12 




B176 


Hex 


03 


XX 


XX 


XX 


Xx 


XX 


XX 


XX 


XX 


XX 


XX 


XX 




XX 


NOTE: 


"xx" shall be the appropriate text using the SMS default 7-bit coded alphabet as defined in TS 23.038 [3] 
which represents the stored SMS. 



NOTE: "xx" shall be the appropriate text using the SMS default 7-bit coded alphabet as defined in TS 23.038 [3] 
which represents the stored SMS. 

At least 9 records. 

Logically: Status byte set to empty 

no text is written (Remainder Bytes set to "FF"). 

Record: 



Coding: 


B1 


B2 


B3 


B4 


B5 


B6 


B7 


B8 


B9 


B10 


B11 


B12 




B176 


Hex 


00 


FF 


FF 


FF 


FF 


FF 


FF 


FF 


FF 


FF 


FF 


FF 




FF 



EFsms (Short Message Service) on the ISIM 

Logically: Status byte set to SMS to be read. 

A chosen test is written in the text body of the EFsms- This content shall be different from the 
content stored in EFsms in the USIM. 

Record 1: 



Byte: 


B1 


B2 


B3 


B4 


B5 


B6 


B7 


B8 


B9 


B10 


B11 


B12 




B176 


Hex: 


03 


yy 


yy 


yy 


Yy 


yy 


yy 


yy 


yy 


yy 


yy 


yy 




yy 


NOTE: 


"yy" shall be the appropriate text using the SMS default 7-bit coded alphabet as defined in TS 23.038 [3] 
which represents the stored SMS. 



NOTE: "yy" shall be the appropriate text using the SMS default 7-bit coded alphabet as defined in TS 23.038 [3] 
which represents the stored SMS. 
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At least 9 records. 

Logically: Status byte set to empty 

no text is written (Remainder Bytes set to "FF"). 

Record: 



Byte: 


B1 


B2 


B3 


B4 


B5 


B6 


B7 


B8 


B9 


B10 


B11 


B12 




B176 


Hex: 


00 


FF 


FF 


FF 


FF 


FF 


FF 


FF 


FF 


FF 


FF 


FF 




FF 



EFsMs on the USIM and EFsms on the ISIM shall not share the same memory. 
EFsMss on the USIM and EFsmss on the ISIM shall not share the same memory. 
User Equipment: 

The User Equipment is connected to the E-UTRAN/EPC ISIM-UICC. 

8.2.5.4.2 Procedure 

a) The UE is switched on. 

b) The user shall read the SMS stored on the USIM. 

3) After step b) the EFSMS and EFSMSS on the ISIM shall remain unchanged. 

c) The UE is switched off 

8.2.5.5 Acceptance criteria 

1) After b) the correct text of the SMS on the USIM shall be read and be displayed to the user. 

2) After step b) the EFsms record 1 of the USIM shall contains the following values: 

Logically: Status byte set to SMS read. 

The entire content of the SMS shall be unchanged. 

Record 1: 



Byte: 


B1 


B2 


B3 


B4 


B5 


B6 


B7 


B8 


B9 


B10 


B11 


B12 




B176 


Hex: 


01 


XX 


XX 


XX 


Xx 


XX 


XX 


XX 


XX 


XX 


XX 


XX 




XX 


NOTE: 


"xx" shall be the appropriate text using the SMS default 7-bit coded alphabet as defined in TS 23.038 [3] 
which represents the stored SMS. 



8.2.6 Correct reading of a SM on the ISIM if USIM and ISIM are present 

8.2.6.1 Definition and applicability 

A SM which is stored but not yet read, is indicated as Status "3" (SMS to be read) on EFsms- The Terminal may indicate 
the user this status. After the SMS is read by the user, the status of the SMS shall be changed to "1" (SMS read). This 
applies to short messages stored on the USIM and to short messages stored on the ISIM. 

8.2.6.2 Confonnance requirement 

A received SM was stored in EFsms on the ISIM and another SM was stored in EFsms on the USIM. The user shall be 
able to read short messages stored on the ISIM. At the time the SMS is read by the user, the status of a received SMS, 
shall be changed to "1" (SMS read). 

- TS 23.038 [3], clause 4. 
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- TS 23.040 [13]; 

- TS 31.102 [4], subclauses 4.2.25 and 4.2.28, 

- TS 31.103 [32], subclauses 4.2.12 and 4.2.13. 

8.2.6.3 Test purpose 

1) To verify that the Terminal correctly reads the SMS on the ISIM if the USIM and ISIM are both present. 

2) To verify that the Terminal changes the status of a read SMS to "1" (SMS read) of the message read from the 
ISIM. 

8.2.6.4 Method of test 
8.2.6.4.1 Initial conditions 

The E-UTRAN/EPC ISIM-UICC is used with the following exception: 
EFusT (USIM Service Table) 

As defined in in clause 4.5.2 with the expection that services n°10 (Short Message Storage) and n°ll (SMS Status 
Report) are available. 

EFsMss (SMS Status) on the USIM and on the ISIM 

Logically: Last used TP-MR not set. 

Memory capacity available (flag unset bl="l"). 



Byte: 


B1 


82 


Hex: 


FF 


FF 



EFsMs (Short Message Service) on the USIM 

Logically: Status byte set to SMS to be read. 

A chosen test is written in the text body of the EFsms- This content shall be different from the 
content stored in EFsms in the ISIM. 

Record 1: 



Coding: 


B1 


B2 


B3 


84 


B5 


B6 


87 


B8 


B9 


B10 


B11 


B12 




B176 


Hex 


03 


XX 


XX 


XX 


Xx 


XX 


XX 


XX 


XX 


XX 


XX 


XX 




XX 


NOTE: 


"xx" shall be the appropriate text using the SMS default 7-bit coded alphabet as defined in TS 23.038 [3] 
which represents the stored SMS. 



NOTE: "xx" shall be the appropriate text using the SMS default 7-bit coded alphabet as defined in TS 23.038 [3] 
which represents the stored SMS. 

At least 9 records. 

Logically: Status byte set to empty 

no text is written (Remainder Bytes set to "FF"). 

Record: 



Coding: 


B1 


B2 


B3 


B4 


B5 


B6 


B7 


B8 


B9 


B10 


B11 


B12 




B176 


Hex 


00 


FF 


FF 


FF 


FF 


FF 


FF 


FF 


FF 


FF 


FF 


FF 




FF 



EFsms (Short Message Service) on the ISIM 

Logically: Status byte set to SMS to be read. 
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A chosen test is written in the text body of the EFsms- This content shall be different from the 
content stored in EFsms in the USIM. 

Record 1: 



Byte: 


B1 


B2 


B3 


B4 


B5 


B6 


B7 


B8 


B9 


B10 


B11 


B12 




B176 


Hex: 


03 


yy 


yy 


yy 


Yy 


yy 


yy 


yy 


yy 


yy 


yy 


yy 




yy 


NOTE: 


"yy" shall be the appropriate text using the SMS default 7-bit coded alphabet as defined in TS 23.038 [3] 
which represents the stored SMS. 



NOTE: "yy" shall be the appropriate text using the SMS default 7-bit coded alphabet as defined in TS 23.038 [3] 
which represents the stored SMS. 

At least 9 records. 

Logically: Status byte set to empty 

no text is written (Remainder Bytes set to "FF"). 

Record: 



Byte: 


B1 


B2 


B3 


B4 


B5 


B6 


B7 


B8 


B9 


B10 


B11 


B12 




B176 


Hex: 


00 


FF 


FF 


FF 


FF 


FF 


FF 


FF 


FF 


FF 


FF 


FF 




FF 



EFsMs on the USIM and EFsms on the ISIM shall not share the same memory. 
EFsMss on the USIM and EFsmss on the ISIM shall not share the same memory. 
User Equipment: 

The User Equipment is connected to the E-UTRAN/EPC ISIM-UICC. 

8.2.6.4.2 Procedure 

a) The UE is switched on. 

b) The user shall read the SMS stored on the USIM. 

c) The UE is switched off 

8.2.6.5 Acceptance criteria 

1) After b) the correct text of the SMS on the ISIM shall be read and be displayed to the user. 

2) After step b) the EFsms record 1 of the ISIM shall contains the following values: 

Logically: Status byte set to SMS read. 

The entire content of the SMS shall be unchanged. 

Record 1: 



Byte: 


B1 


B2 


B3 


B4 


B5 


B6 


B7 


B8 


B9 


B10 


B11 


B12 




B176 


Hex: 


01 


yy 


yy 


yy 


yy 


yy 


yy 


yy 


yy 


yy 


yy 


yy 




Yy 


NOTE: 


"yy" shall be the appropriate text using the SMS default 7-bit coded alphabet as defined in TS 23.038 [3] 
which represents the stored SMS. 



3) After step b) the EFsms and EFsmss on the USIM shall remain unchanged. 
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8.3 MMS related tests 

8.3.1 UE recognising the priority order of MMS Issuer Connectivity 
Parameters 

8.3.1 .1 Definition and applicability 

An MMS User Agent shall use the MMS related information stored in the USIM, if present, unless otherwise specified 
by the user. Some of these sets of MMS connectivity parameters are preset by the issuer of the USIM with the first 
supported set being the default. This information is used to connect to the network for purpose of accessing the MMS 
Relay/Server. 

The MMS connectivity information on the USIM includes preferences for the selection of Interface to Core Network 
and Bearer parameters. If these are stored on the USIM the MMS-capable UE shall automatically select the Interface to 
Core Network and Bearer parameters based on their order of precedence defined on the USIM unless otherwise 
specified by the user. 

MMS user preferences information, which is stored on the USIM, shall be used by an MMS User Agent for user 
assistance in preparation of terminal-originated MMs (e.g. default values for parameters that are often used). 

8.3.1 .2 Conformance requirement 

The Terminal's MMS User Agent shall use the MMS connectivity parameters stored first in the supported parameter 
sets of EFmmsicp as default parameters to connect to the network for MMS purposes (i.e. sending an User generated 
MM). 

- TS 31.102 [4], subclauses 4.2.69 and 5.3.30; 

- TS 23.140 [23], subclause 7.1.14 and Annex F. 

MMS user preferences information, which is stored on the USIM, shall be used by an MMS User Agent for user 
assistance in preparation of terminal-originated MMs. 

- TS 31.102 [4], subclauses 4.2.70 and 5.3.31; 

- TS 23.140 [23], subclause 7.1.14 and Annex F. 

8.3.1.3 Test purpose 

1) To verify that the Terminal's MMS User Agent uses the MMS connectivity parameter stored on the USIM to 
connect to the network for MMS purposes. 

2) To verify that the Terminal's MMS User Agent uses the first stored set of supported parameters in EFmmsicp as 
default. 

3) To verify that the Terminal's MMS User Agent uses the MMS user preference information stored on the USIM 
for user assistance in preparation of terminal-originated MMs. 

8.3.1.4 Method of test 
8.3.1 .4.1 Initial conditions 

Four MMS Relays/Servers are available: 
MMS Relay/Server 1: 
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7) MMS Connectivity Parameters 

MMS implementation information: 
MMS Relay/Server 

MMS Relay/Server information: 
Interface to Core Network and Bearer 

Bearer: 

Address: 

Type of address: 

Speed: 

Call type: 

Authentication type: 
Authentication id: 
Authentication pw: 
Gateway 
Address: 
Type of address: 
Port : 
Service: 

Authentication type: 
Authentication id: 
Authentication pw: 
MMS Relay/Server 2: 

7) MMS Connectivity Parameters 

MMS implementation information: 
MMS Relay/Server 

MMS Relay/Server information: 
Interface to Core Network and Bearer 

Bearer: 

Address: 

Type of address: 

Speed: 

Call type: 

Authentication type: 
Authentication id: 
Authentication pw: 
Gateway 
Address: 
Type of address: 
Port: 
Service: 

Authentication type: 
Authentication id: 
Authentication pw: 



"WAP" 

"http:// mms-operatorl .com 

"GSM-CSD" 

"+496998625" 

"E164" 

"Autobauding" 

"ANALOG_MODEM" 

"PAP" 

"B2B_0TS1" 
"B2B_passwordl" 

"170.187.51.3" 

"Ipv4" 

"9201" 

"CO-WSP" 

"HTTP BASIC" 

"gateway_userl" 

"gateway_passwordl " 



"WAP" 

" http :// mms-operatorl .com 

"GSM-CSD" 

"+496998626" 

"E164" 

"Autobauding" 

"ANALOG_MODEM" 

"PAP" 

"B2C_OTS2" 
"B2C_password2" 

"170.187.51.3" 

"Ipv4" 

"9201" 

"CO-WSP" 

"HTTP BASIC" 

"gateway_userl" 

" gate way_pas sword 1 " 



MMS Relay/Server 3: 
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7) MMS Connectivity Parameters 

MMS implementation information: 
MMS Relay/Server 

MMS Relay/Server information: 
Interface to Core Network and Bearer 

Bearer: 

Address: 

Type of address: 

Call type: 

Delivery of erroneous SDU: 
Residual Bit Error Rate: 
SDU-Error-Ratio: 
Traffic-class: 

Maximum bit rate for downlink: 
Authentication type: 
Authentication id: 
Authentication pw: 
Gateway 
Address: 
Type of address: 
Port: 
Service: 

Authentication type: 
Authentication id: 
Authentication pw: 



"WAP" 

"http:// mms-operatorl .com 

"GSM-GPRS" 
"wap.B2B -operator 1 .com" 
"APN" 

"ANALOG_MODEM" 

"No" 

"1*10"^" 

"1*10-6" 

"Interactive class" 
"8 kbps" 
"PAP" 

"B2B_0TS1" 
"B2B_passwordl" 

"170.187.51.3" 

"Ipv4" 

"9201" 

"CO-WSP" 

"HTTP BASIC" 

"gateway_userl" 

" gate way_pas sword 1 " 



MMS Relay/Server 4: 



7) MMS Connectivity Parameters 

MMS implementation information: 
MMS Relay/Server 

MMS Relay/Server information: 
Interface to Core Network and Bearer 

Bearer: 

Address: 

Type of address: 

Call type: 

Delivery of erroneous SDU: 
Residual Bit Error Rate: 
SDU-Error-Ratio: 
Traffic-class: 

Maximum bit rate for downlink: 
Authentication type: 
Authentication id: 
Authentication pw: 
Gateway 
Address: 
Type of address: 
Port : 
Service: 

Authentication type: 
Authentication id: 
Authentication pw: 



"WAP" 

" http :// mms-operatorl .com 

"GSM-GPRS" 

" wap.B2C-operatorl .com" 

"APN" 

"ANALOG_MODEM" 

"No" 

"1*10"^" 

"1*10-6" 

"Interactive class" 
"8 kbps" 
"PAP" 

"B2C_OTS2" 
"B2C_password2" 

"170.187.51.3" 

"Ipv4" 

"9201" 

"CO-WSP" 

"HTTP BASIC" 

"gateway_userl" 

"gateway_passwordl " 



The default UICC is used with the following exceptions: 
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EFusT (USIM Service Table) 

Logically: Local Phone Book available 

User controlled PLMN selector available 
Fixed dialling numbers available 
Barred dialling numbers available 
The GSM Access available 

The Group Identifier level 1 and level 2 not available 
SMS available 
SMS Status available 

Service no. 33 (Packed Switched Domain) shall be set to T 
Service no. 52 Multimedia Messaging Service available 
Service no. 55 MMS User Connectivity Parameters not available 

B1 B2 B3 B4 B5 B6 



Coding: 
Binary 



xx1x xx1 1 



x1 1 X xxxx 



xxxx 1 xOO 



xxxx x1 XX 



xxxx XXX 1 



xxxx xxxx 



B7 

XOXX 1 XXX 



EFi 



MMSN 

Logically: 

MMS Status: 
MMS Implementation : 
MMS Notification: 
Extension file record number: 



Coding: B1 
00 



B2 
00 



B3 
00 



Free space 
"GO" 

"FF FF ... 

"FF" 

B4 
FF 



FF" (251 bytes) 

B5 
FF 



B254 
FF 



B255 
FF 



EFi 



MMSICP 

Logically: 

MIVIS Connectivity Parameters 
IVIIVIS Implementation 

MMS Implementation Information : 
IVIIVIS Relay/Server 

MMS Relay/Server Address 
1^^ Interface to Core Network and Bearer 

Bearer: 

Address: 

Type of address: 

Speed: 

Call type: 

Authentication type: 
Authentication id: 
Authentication pw: 
2"^ Interface to Core Network and Bearer 
Bearer: 
Address: 
Type of address: 
Speed: 
Call type: 

Authentication type: 
Authentication id: 
Authentication pw: 
3^^ Interface to Core Network and Bearer 
Bearer: 
Address: 
Type of address: 
Call type: 

Delivery of erroneous SDU: 
Residual Bit Error Rate: 



"WAP" 

"http:// mms-operatorl .com " 

"GSM-CSD" 

"+496998625" 

"E164" 

"Autobauding" 

"ANALOG_MODEM" 

"PAP" 

"B2B_0TS1" 
"B2B_passwordl " 

"GSM-CSD" 

"+496998626" 

"E164" 

"Autobauding" 

"ANALOG_MODEM" 

"PAP" 

"B2C_OTS2" 
"B2C_password2" 

"GSM-GPRS" 
"wap.B2B -operator 1 .com" 
"APN" 

"ANALOG_MODEM" 

"No" 

"1*10-^" 
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SDU-Error-Ratio: 


"1*10"^" 


Traffic-class: 


"Interactive class" 


Maximum bit rate for downlink: 


"8 kbps" 


Authentication type: 


"PAP" 


Authentication id: 


"B2B_0TS1" 


Authentication pw: 


"B2B_passwordl" 


Interface to Core Network and Bearer 




Bearer: 


"GSM-GPRS" 


Address: 


" wap.B2C-operator 1 .com' 


Type of address: 


"APN" 


Call type: 


"ANALOG_MODEM" 


Delivery of erroneous SDU: 


"No" 


Residual Bit Error Rate: 


"1*10"^" 


SDU-Error-Ratio: 


"1*10"^" 


Traffic-class: 


"Interactive class" 


Maximum bit rate for downlink: 


"8 kbps" 


Authentication type: 


"PAP" 


Authentication id: 


"B2C_OTS2" 


Authentication pw: 


"B2C_password2" 


teway: 




Address: 


"170.187.51.3" 


Type of address: 


"Ipv4" 


Port : 


"9201" 


Service: 


"CO-WSP" 


Authentication type: 


"HTTP BASIC" 


Authentication id: 


"gateway_userl" 


Authentication pw: 


" gate way_pas sword 1 " 



Coding: AB 


82 


01 


47 


80 


01 


01 


81 


18 


68 


74 


74 


70 


3A 


2F 


2F 


6D 


6D 


73 


2E 


6F 


70 


65 


72 


61 


74 


6F 


72 


31 


2E 


63 


6F 


6D 


82 


2F 


10 


AA 


08 


2B 


34 


39 


36 


39 


39 


38 


36 


32 


35 


00 


09 


87 


25 


C5 


OA 


90 


OC 


9A 


OD 


42 


32 


42 


11 


4F 


54 


53 


31 


00 


OE 


42 


32 


42 


11 


70 


61 


73 


73 


77 


6F 


72 


64 


31 


00 


82 


2F 


10 


AA 


08 


2B 


34 


39 


36 


39 


39 


38 


36 


32 


36 


00 


09 


87 


25 


C5 


OA 


90 


OC 


9A 


OD 


42 


32 


43 


11 


4F 


54 


53 


32 


00 


OE 


42 


32 


43 


11 


70 


61 


73 


73 


77 


6F 


72 


64 


32 


00 


82 


43 


10 


AB 


08 


03 


77 


61 


70 


OD 


42 


32 


42 


2D 


6F 


70 


65 


72 


61 


74 


6F 


72 


31 


03 


63 


6F 


6D 


00 


09 


89 


OA 


90 


31 


03 


37 


70 


38 


06 


33 


60 


36 


08 


OC 


9A 


OD 


42 


32 


42 


11 


4F 


54 


53 
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EFmmsup 
Logically: 
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MMS Implementation 

MMS implementation information: "WAP" 
MMS User Preference Profile Name: "Greeting cards" 
MMS User Information Preference Information 



Visibility: 
Delivery report: 
Read-reply: 
Priority: 
Delivery-Time: 

Value (absolute): 
Expiry: 

Value (relative): 



"hide" 
"yes" 
"yes" 
"normal" 

"l-Jan-2003, 12:00:00 AM GMT" 
1104537600 seconds 
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The UICC is installed into the Terminal and the user has indicated the data stored in EFmmsicp as default. 



8.3.1.4.2 Procedure 

a) The Terminal is powered on and the PIN shall be entered. 

b) When the Terminal is in idle mode the user shall generate an MM using the MMS User Agent on the Terminal 
with the default MMS connectivity settings provided by the card issuer and the MMS user preference 
information stored in the card and send it to "h-O 123456789". 

8.3.1 .5 Acceptance criteria 

1) After step b) the Terminal shall have read the set of supported MMS connectivity parameters stored first in 
EFmmsicp- 

2) After step b) the Terminal shall have sent the MM to "+01 23456789" using the MMS connectivity parameters 
stored first in the supported parameter sets in EFmmsicp- 

3) After step b) the Terminal shall have sent the MM to "+0123456789" using the MMS user preference 
information stored in EFmmsup- 



8.3.2 UE recognising the priority order of MMS User Connectivity 
Parameters 



8.3.2.1 Definition and applicability 

An MMS User Agent shall use the MMS related information stored in the USIM, if present, unless otherwise specified 
by the user. The MMS connectivity parameters determined by the user, with the first supported set being the default, 
shall be used to connect to the network for purpose of accessing the MMS Relay/Server. 

The MMS connectivity information on the USIM includes preferences for the selection of Interface to Core Network 
and Bearer parameters. If these are stored on the USIM the MMS-capable UE shall automatically select the Interface to 
Core Network and Bearer parameters based on their order of precedence defined on the USIM unless otherwise 
specified by the user. 

MMS user preferences information, which is stored on the USIM, shall be used by an MMS User Agent for user 
assistance in preparation of terminal-originated MMs (e.g. default values for parameters that are often used). 



8.3.2.2 Conformance requirement 

When using the MMS User Connectivity Parameters to connect to the network for MMS purposes (i.e. sending an User 
generated MM), the Terminal's MMS User Agent shall use the MMS User Connectivity Parameters with the highest 
priority (as defined by its position in EFmmsucp) unless otherwise specified by the user. 
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- TS 31.102 [4], subclauses 4.2.71 and 5.3.32; 

- TS 23.140 [23], subclause 7.1.14 and Annex F. 

MMS user preferences information, which is stored on the USIM, shall be used by an MMS User Agent for user 
assistance in preparation of terminal-originated MMs. 

- TS 31.102 [4], subclauses 4.2.70 and 5.3.31; 

- TS 23.140 [23], subclause 7.1.14 and Annex F. 

8.3.2.3 Test purpose 

1) To verify that the Terminal's MMS User Agent uses the MMS connectivity parameter stored on the USIM to 
connect to the network for MMS purposes. 

2) To verify that when using the MMS User Connectivity Parameters to connect to the network for MMS purposes 
the Terminal's MMS User Agent uses the set of supported parameters in EF MMSUCP with the highest priority 
(as defined by its position in EFmmsucp)- 

3) To verify that the Terminal's MMS User Agent uses the MMS user preference information stored on the USIM 
for user assistance in preparation of terminal-originated MMs. 

8.3.2.4 Method of test 
8.3.2.4.1 Initial conditions 

Four MMS Relays/Servers are available: 
MMS Relay/Server 1: 

7) MMS Connectivity Parameters 

MMS implementation information 
MMS Relay/Server 

MMS Relay/Server information: 
Interface to Core Network and Bearer 

Bearer: 

Address: 

Type of address: 

Speed: 

Call type: 

Authentication type: 
Authentication id: 
Authentication pw: 
Gateway 
Address: 
Type of address: 
Port : 
Service: 

Authentication type: 
Authentication id: 
Authentication pw: 



"WAP" 

"http:// mms-operator2.com " 

"GSM-CSD" 
"+49525 1699" 
"E164" 

"Autobauding" 

"ANALOG_MODEM" 

"PAP" 

"UD0_0TS1" 
"Udo_passwordl " 

"170.187.51.4" 

"Ipv4" 

"9203" 

"CO-WSP" 

"HTTP BASIC" 

"gateway_user7" 

' ' gate way_pas s word7 ' ' 



MMS Relay/Server 2: 
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7) MMS Connectivity Parameters 

MMS implementation information: 
MMS Relay/Server 

MMS Relay/Server information: 
Interface to Core Network and Bearer 

Bearer: 

Address: 

Type of address: 

Speed: 

Call type: 

Authentication type: 
Authentication id: 
Authentication pw: 
Gateway 
Address: 
Type of address: 
Port : 
Service: 

Authentication type: 
Authentication id: 
Authentication pw: 



"WAP" 

"http:// mms-operator2.com 

"GSM-CSD" 
"+49525 1700" 
"E164" 

"Autobauding" 

"ANALOG_MODEM" 

"PAP" 

"UD0_0TS2" 
"Udo_password2" 

"170.187.51.4" 

"Ipv4" 

"9203" 

"CO-WSP" 

"HTTP BASIC" 

"gateway_user7" 

" gateway_password7 " 



MMS Relay/Server 3: 

7) MMS Connectivity Parameters 

MMS implementation information: 
MMS Relay/Server 

MMS Relay/Server information: 
Interface to Core Network and Bearer 

Bearer: 

Address: 

Type of address: 

Call type: 

Delivery of erroneous SDU: 
Residual Bit Error Rate: 
SDU-Error-Ratio: 
Traffic-class: 

Maximum bit rate for downlink: 
Authentication type: 
Authentication id: 
Authentication pw: 
Gateway 
Address: 
Type of address: 
Port : 
Service: 

Authentication type: 
Authentication id: 
Authentication pw: 



"WAP" 

"http:// mms-operator2.com 

"GSM-GPRS" 

"wap.B2B-operator2.com" 

"APN" 

"ANALOG_MODEM" 

"No" 

"1*10"^" 

"1*10-^" 

"Interactive class" 
"8 kbps" 
"PAP" 

"UD0_0TS1" 
"Udo_passwordl " 

"170.187.51.4" 

"Ipv4" 

"9203" 

"CO-WSP" 

"HTTP BASIC" 

"gateway_user7" 

" gateway_password7 " 



MMS Relay/Server 4: 
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7) MMS Connectivity Parameters 

MMS implementation information: 
MMS Relay/Server 

MMS Relay/Server information: 
Interface to Core Network and Bearer 

Bearer: 

Address: 

Type of address: 

Call type: 

Delivery of erroneous SDU: 
Residual Bit Error Rate: 
SDU-Error-Ratio: 
Traffic-class: 

Maximum bit rate for downlink: 
Authentication type: 
Authentication id: 
Authentication pw: 
Gateway 
Address: 
Type of address: 
Port: 
Service: 

Authentication type: 
Authentication id: 
Authentication pw: 



"WAP" 

"http:// mms-operator2.com " 

"GSM-GPRS" 

"wap.B2C-operator2.com" 

"APN" 

"ANALOG_MODEM" 

"No" 

"1*10"^" 

"1*10-6" 

"Interactive class" 
"8 kbps" 
"PAP" 

"UD0_0TS2" 
" Udo_pass word2 " 

"170.187.51.4" 

"Ipv4" 

"9203" 

"CO-WSP" 

"HTTP BASIC" 

"gateway_user7" 

"gateway_password7 " 



The default UICC is used with the following exceptions: 

EFusT (USIM Service Table) 

Logically: Local Phone Book available 

User controlled PLMN selector available 
Fixed dialling numbers available 
Barred dialling numbers available 
The GSM Access available 

The Group Identifier level 1 and level 2 not available 
SMS available 
SMS Status available 

Service no. 33 (Packed Switched Domain) shall be set to T 
Service no. 52 Multimedia Messaging Service available 
Service no. 55 MMS User Connectivity Parameters available 

Coding: B1 B2 B3 B4 B5 

Binary xx1 x xx11 x11 x xxxx xxxx 1 xOO xxxx x1 xx xxxx xxx1 



B6 B7 

xxxx xxxx X1 XX 1 XXX 



EFmmsn 
Logically: 

MMS Status: Free space 

MMS Implementation : "00" 

MMS Notification: "FF FF . . . EE" (251 bytes) 

Extension file record number: "FF" 

Coding: B1 B2 B3 B4 B5 ... B254 B255 

00 00 00 FF FF FF FF 



EFi 



MMSICP 



Logically: Empty 

Coding: B1 B2 ... Bxx 
FF FF FF 
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EFi 



MMSUP 



Logically: 

MMS Implementation 

MMS implementation information: "WAP" 
MMS User Preference Profile Name: "Greeting cards" 
MMS User Information Preference Information 



Visibility: 
Delivery report: 
Read-reply: 
Priority: 
Delivery-Time: 

Value (absolute): 
Expiry: 

Value (relative): 



"hide" 
"yes" 
"yes" 
"normal" 

"l-Jan-2003, 12:00:00 AM GMT" 
1104537600 seconds 
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EFmmsucp 

Logically: 

MMS Connectivity Parameters 
IVIIVIS Implementation 

MMS Implementation Information : 
IVIIVIS Relay/Server 

MMS Relay/Server Address 
1^^ Interface to Core Network and Bearer 

Bearer: 

Address: 

Type of address: 

Speed: 

Call type: 

Authentication type: 
Authentication id: 
Authentication pw: 
2"^ Interface to Core Network and Bearer 
Bearer: 
Address: 
Type of address: 
Speed: 
Call type: 

Authentication type: 
Authentication id: 
Authentication pw: 
3^^ Interface to Core Network and Bearer 
Bearer: 
Address: 
Type of address: 
Call type: 

Delivery of erroneous SDU: 
Residual Bit Error Rate: 
SDU-Error-Ratio: 
Traffic-class: 

Maximum bit rate for downlink: 
Authentication type: 
Authentication id: 
Authentication pw: 
4* Interface to Core Network and Bearer 
Bearer: 
Address: 
Type of address: 
Call type: 

Delivery of erroneous SDU: 
Residual Bit Error Rate: 
SDU-Error-Ratio: 
Traffic-class: 

Maximum bit rate for downlink: 
Authentication type: 
Authentication id: 
Authentication pw: 
Gateway: 
Address: 
Type of address: 
Port : 
Service: 

Authentication type: 
Authentication id: 
Authentication pw: 



"WAP" 

"http:// mms-operator2.com " 

"GSM-CSD" 
"+49525 1699" 
"E164" 

"Autobauding" 

"ANALOG_MODEM" 

"PAP" 

"UD0_0TS1" 
"Udo_passwordl " 

"GSM-CSD" 
"+49525 1700" 
"E164" 

"Autobauding" 

"ANALOG_MODEM" 

"PAP" 

"UD0_0TS2" 
"Udo_password2" 

"GSM-GPRS" 

' ' wap . B 2B -operator2 . com' ' 

"APN" 

"ANALOG_MODEM" 

"No" 

"1*10"^" 

"1*10"^" 

"Interactive class" 
"8 kbps" 
"PAP" 

"UD0_0TS1" 
"Udo_passwordl " 

"GSM-GPRS" 

"wap.B2C-operator2.com" 

"APN" 

"ANALOG_MODEM" 

"No" 

"1*10"^" 

"1*10"^" 

"Interactive class" 
"8 kbps" 
"PAP" 

"UD0_0TS2" 
"Udo_password2" 

"170.187.51.4" 

"Ipv4" 

"9203" 

"CO-WSP" 

"HTTP BASIC" 

"gateway_user7" 

"gateway_password7 " 
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Coding: AB 
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The UICC is installed into the Terminal and the user has indicated the data stored in EpMMsucpas default. 

8.3.2.4.2 Procedure 

a) The Terminal is powered on and the PIN shall be entered. 

b) When the Terminal is in idle mode the user shall generate an MM using the MMS User Agent on the Terminal 
with the default MMS User Connectivity Parameters and the MMS user preference information stored in the 
card and send it to "+0123456789". 

8.3.2.5 Acceptance criteria 

1) After step b) the Terminal shall have read the first supported set of MMS connectivity parameters stored in 
EFmmsucp- 

2) After step b) the Terminal shall have sent the MM to "+0123456789" using the MMS User Connectivity 
Parameter set with the highest priority (as defined by its position in EFmmsucp)? which can be used to access an 
available MMS Relay/Server. 

3) After step b) the Terminal shall have sent the MM to "+0123456789" using the MMS user preference 
information stored in EFmmsucp- 

8.3.3 UE recognising the priority order of MMS Issuer Connectivity 
Parameters over the MMS User Connectivity Parameters 

8.3.3.1 Definition and applicability 

An MMS User Agent shall use the MMS related information stored in the USIM, if present, unless otherwise specified 
by the user. This information comprises MMS connectivity information, MMS user preferences and MMS notifications. 

MMS user preferences information, which is stored on the USIM, shall be used by an MMS User Agent for user 
assistance in preparation of terminal-originated MMs (e.g. default values for parameters that are often used). 
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8.3.3.2 Conformance requirement 

MMS connectivity information, on the USIM includes a number of sets of MMS connectivity parameters. Some of 
these sets of MMS connectivity parameters are preset by the issuer of the USIM with the first set being the default. 
Such default preset MMS connectivity parameter set shall be selected unless otherwise specified by the user. 

- TS 31.102 [4], subclauses 4.2.69, 4.7.71, 5.3.30 and 5.3.32; 

- TS 23.140 [23], subclause 7.1.14 and Annex F 

8.3.3.3 Test purpose 

1) To verify that the Terminal's MMS User Agent uses the MMS connectivity parameter stored on the USIM to 
connect to the network for MMS purposes. 

2) To verify that a MMS Issuer Connectivity Parameter set with lower priority (as defined by its position in 
EFmmsicp) takes precedence over a MMS User Connectivity Parameter set with a higher priority. 

8.3.3.4 Method of test 
8.3.3.4.1 Initial conditions 

Four MMS Relays/Servers are available: 
MMS Relay/Server 1: 

7) MMS Connectivity Parameters 

MMS implementation information 
MMS Relay/Server 

MMS Relay/Server information: 
Interface to Core Network and Bearer 

Bearer: 

Address: 

Type of address: 

Speed: 

Call type: 

Authentication type: 
Authentication id: 
Authentication pw: 
Gateway 
Address: 
Type of address: 
Port : 
Service: 

Authentication type: 
Authentication id: 
Authentication pw: 



"WAP" 

"http:// mms-operator3.com " 

"GSM-CSD" 
"+49525 1699" 
"E164" 

"Autobauding" 

"ANALOG_MODEM" 

"PAP" 

"UD0_0TS1" 
"Udo_passwordl " 

"170.187.51.5" 

"Ipv4" 

"9201" 

"CO-WSP" 

"HTTP BASIC" 

"gateway_user9" 

" gate way_pass word9 " 
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MMS Relay/Server 2: 



7) MMS Connectivity Parameters 

MMS implementation information: 
MMS Relay/Server 

MMS Relay/Server information: 
Interface to Core Network and Bearer 

Bearer: 

Address: 

Type of address: 

Call type: 

Delivery of erroneous SDU: 
Residual Bit Error Rate: 
SDU-Error-Ratio: 
Traffic-class: 

Maximum bit rate for downlink: 
Authentication type: 
Authentication id: 
Authentication pw: 
Gateway 
Address: 
Type of address: 
Port : 
Service: 

Authentication type: 
Authentication id: 
Authentication pw: 



"WAP" 

' ' http :// mms-operator3 .com 

"GSM-GPRS" 

" wap .B 2P-operator3 . com" 

"APN" 

"ANALOG_MODEM" 

"No" 

"1*10"^" 

"1*10"^" 

"Interactive class" 
"8 kbps" 
"PAP" 

"UD0_0TS1" 
"Udo_passwordl " 

"170.187.51.5" 

"Ipv4" 

"9201" 

"CO-WSP" 

"HTTP BASIC" 

"gateway_user9" 

' ' gate way_pas s word9 ' ' 



MMS Relay/Server 3: 



7) MMS Connectivity Parameters 

MMS implementation information: 
MMS Relay/Server 

MMS Relay/Server information: 
Interface to Core Network and Bearer 

Bearer: 

Address: 

Type of address: 

Speed: 

Call type: 

Authentication type: 
Authentication id: 
Authentication pw: 
Gateway 
Address: 
Type of address: 
Port : 
Service: 

Authentication type: 
Authentication id: 
Authentication pw: 



"WAP" 

"http :// mms-operator3 .com 

"GSM-CSD" 

"+496998626" 

"E164" 

"Autobauding" 

"ANALOG_MODEM" 

"PAP" 

"B2C_OTS2" 
"B2C_password2" 

"170.187.51.5" 

"Ipv4" 

"9201" 

"CO-WSP" 

"HTTP BASIC" 

"gateway_user9" 

"gateway_password9" 
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MMS Relay/Server 4: 

7) MMS Connectivity Parameters 

MMS implementation information: 
MMS Relay/Server 

MMS Relay/Server information: 
Interface to Core Network and Bearer 

Bearer: 

Address: 

Type of address: 

Call type: 

Delivery of erroneous SDU: 
Residual Bit Error Rate: 
SDU-Error-Ratio: 
Traffic-class: 

Maximum bit rate for downlink: 
Authentication type: 
Authentication id: 
Authentication pw: 
Gateway 
Address: 
Type of address: 
Port : 
Service: 

Authentication type: 
Authentication id: 
Authentication pw: 



"WAP" 

' ' http :// mms-operator3 .com " 

"GSM-GPRS" 

" wap .B 2C-operator3 .com" 

"APN" 

"ANALOG_MODEM" 

"No" 

"1*10"^" 

"1*10"^" 

"Interactive class" 
"8 kbps" 
"PAP" 

"B2C_OTS2" 
"B2C_password2" 

"170.187.51.5" 

"Ipv4" 

"9201" 

"CO-WSP" 

"HTTP BASIC" 

"gateway_user9" 

' ' gate way_pas s word9 ' ' 



The default UICC is used with the following exceptions: 

EFusT (USIM Service Table) 

Logically: Local Phone Book available 

User controlled PLMN selector available 
Fixed dialling numbers available 
Barred dialling numbers available 
The GSM Access available 

The Group Identifier level 1 and level 2 not available 
SMS available 
SMS Status available 

Service no. 33 (Packed Switched Domain) shall be set to T 
Service no. 52 Multimedia Messaging Service available 
Service no. 55 MMS User Connectivity Parameters available 

B1 B2 B3 B4 B5 



Coding: 
Binary 



xx1x xx1 1 



x1 1 X xxxx 



xxxx 1 xOO 



xxxx x1 XX 



xxxx XXX 1 



B6 

xxxx xxxx 



B7 

X1 XX 1 XXX 



EFi 



MMSN 



Logically: 

MMS Status: 

MMS Implementation : 

MMS Notification: 



Free space 
"00" 

"EE EE ... EE" (251 bytes) 



Extension file record number: "EE" 



Coding: B1 
GO 



B2 
GO 



B3 
GG 



B4 
FF 



B5 
FF 



B254 
FF 



B255 
FF 



EFi 



MMSICP 
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Logically: 

MMS Connectivity Parameters 
IVIIVIS Implementation 

MMS Implementation Information : 
IVIIVIS Relay/Server 

MMS Relay/Server Address 
1^^ Interface to Core Network and Bearer 

Bearer: 

Address: 

Type of address: 

Speed: 

Call type: 

Authentication type: 
Authentication id: 
Authentication pw: 
2"^ Interface to Core Network and Bearer 
Bearer: 
Address: 
Type of address: 
Speed: 
Call type: 

Authentication type: 
Authentication id: 
Authentication pw: 
3^^ Interface to Core Network and Bearer 
Bearer: 
Address: 
Type of address: 
Call type: 

Delivery of erroneous SDU: 
Residual Bit Error Rate: 
SDU-Error-Ratio: 
Traffic-class: 

Maximum bit rate for downlink: 
Authentication type: 
Authentication id: 
Authentication pw: 
4* Interface to Core Network and Bearer 
Bearer: 
Address: 
Type of address: 
Call type: 

Delivery of erroneous SDU: 
Residual Bit Error Rate: 
SDU-Error-Ratio: 
Traffic-class: 

Maximum bit rate for downlink: 
Authentication type: 
Authentication id: 
Authentication pw: 
Gateway: 
Address: 
Type of address: 
Port : 
Service: 

Authentication type: 
Authentication id: 
Authentication pw: 



"WAP" 

" http :// mms-operator3 .com " 

"GSM-CSD" 

"+496998625" 

"E164" 

"Autobauding" 

"ANALOG_MODEM" 

"PAP" 

"B2B_0TS1" 
"B2B_passwordl " 

"GSM-CSD" 

"+496998626" 

"E164" 

"Autobauding" 

"ANALOG_MODEM" 

"PAP" 

"B2C_OTS2" 
"B2C_password2" 

"GSM-GPRS" 

" wap .B 2B -operators .com" 

"APN" 

"ANALOG_MODEM" 

"No" 

"1*10"^" 

"Interactive class" 
"8 kbps" 
"PAP" 

"B2B_0TS1" 
"B2B_passwordl " 

"GSM-GPRS" 

" wap .B 2C-operator3 .com" 

"APN" 

"ANALOG_MODEM" 

"No" 

"1*10"^" 

"1*10'^" 

"Interactive class" 
"8 kbps" 
"PAP" 

"B2C_OTS2" 
"B2C_password2" 

"170.187.51.5" 

"Ipv4" 

"9201" 

"CO-WSP" 

"HTTP BASIC" 

"gateway_user9" 

' ' gate way_pas s word9 ' ' 
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Coding: 



AB 


82 


01 


47 


80 


70 


3A 


2F 


2F 


6D 


61 


74 


6F 


72 


33 


AA 


08 


2B 


34 


39 


00 


09 


87 


25 


C5 


42 


1 1 


4F 


54 


53 


70 


61 


73 


73 


77 


10 


AA 


08 


2B 


34 


36 


00 


09 


87 


25 


32 


43 


11 


4F 


54 


11 


70 


61 


73 


73 


43 


10 


AB 


08 


03 


2D 


6F 


70 


65 


72 


6F 


6D 


00 


09 


89 


06 


33 


60 


36 


08 


4F 


54 


53 


31 


00 


73 


73 


77 


6F 


72 


08 


03 


77 


61 


70 


65 


72 


61 


74 


6F 


09 


89 


OA 


90 


31 


36 


08 


OC 


9A 


OD 


32 


00 


OE 


42 


32 


6F 


72 


64 


32 


00 


31 


38 


37 


2E 


35 


39 


32 


30 


31 


00 


74 


65 


77 


61 


79 


IB 


67 


61 


74 


65 


73 


77 


6F 


72 


64 



01 


01 


81 


18 


68 


74 


74 


6D 


73 


2E 


6F 


70 


65 


72 


2E 


63 


6F 


6D 


82 


2F 


10 


36 


39 


39 


38 


36 


32 


35 


OA 


90 


OC 


9A 


OD 


42 


32 


31 


00 


OE 


42 


32 


42 


1 1 


6F 


72 


64 


31 


00 


82 


2F 


39 


36 


39 


39 


38 


36 


32 


C5 


OA 


90 


OC 


9A 


OD 


42 


53 


32 


00 


OE 


42 


32 


43 


77 


6F 


72 


64 


32 


00 


82 


77 


61 


70 


OD 


42 


32 


42 


61 


74 


6F 


72 


33 


03 


63 


OA 


90 


31 


03 


37 


70 


38 


OC 


9A 


OD 


42 


32 


42 


1 1 


OE 


42 


32 


42 


1 1 


70 


61 


64 


31 


00 


82 


43 


10 


AB 


OD 


42 


32 


43 


2D 


6F 


70 


72 


33 


03 


63 


6F 


6D 


00 


03 


37 


70 


38 


06 


33 


60 


42 


32 


43 


11 


4F 


54 


53 


43 


11 


70 


61 


73 


73 


77 


83 


3B 


20 


31 


37 


30 


2E 


31 


2E 


35 


00 


21 


85 


23 


24 


CB 


19 


9C 


1A 


67 


61 


11 


75 


73 


65 


72 


39 


00 


77 


61 


79 


11 


70 


61 


73 



39 00 



EFi 



MMSUP 



Logically: 



MMS Implementation 

MMS implementation information: "WAP" 

MMS User Preference Profile Name: "Greeting cards" 
MMS User Information Preference Information 

Visibility: "hide" 

Delivery report: "yes" 

Read-reply: "yes" 

Priority: "normal" 

Delivery-Time: 

Value (absolute): " l-Jan-2003, 12:00:00 AM GMT" 
Expiry: 

Value (relative): 1 104537600 seconds 
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EFmmsucp 

Logically: 

MMS Connectivity Parameters 
IVIIVIS Implementation 

MMS Implementation Information : 
IVIIVIS Relay/Server 

MMS Relay/Server Address 
1^^ Interface to Core Network and Bearer 

Bearer: 

Address: 

Type of address: 

Speed: 

Call type: 

Authentication type: 
Authentication id: 
Authentication pw: 
2"^ Interface to Core Network and Bearer 
Bearer: 
Address: 
Type of address: 
Speed: 
Call type: 

Authentication type: 
Authentication id: 
Authentication pw: 
3^^ Interface to Core Network and Bearer 
Bearer: 
Address: 
Type of address: 
Call type: 

Delivery of erroneous SDU: 
Residual Bit Error Rate: 
SDU-Error-Ratio: 
Traffic-class: 

Maximum bit rate for downlink: 
Authentication type: 
Authentication id: 
Authentication pw: 
4* Interface to Core Network and Bearer 
Bearer: 
Address: 
Type of address: 
Call type: 

Delivery of erroneous SDU: 
Residual Bit Error Rate: 
SDU-Error-Ratio: 
Traffic-class: 

Maximum bit rate for downlink: 
Authentication type: 
Authentication id: 
Authentication pw: 
Gateway: 
Address: 
Type of address: 
Port : 
Service: 

Authentication type: 
Authentication id: 
Authentication pw: 



"WAP" 

"http:// mms-operator3.com " 

"GSM-CSD" 
"+49525 1699" 
"E164" 

"Autobauding" 

"ANALOG_MODEM" 

"PAP" 

"UD0_0TS1" 
"Udo_passwordl " 

"GSM-CSD" 
"+49525 1700" 
"E164" 

"Autobauding" 

"ANALOG_MODEM" 

"PAP" 

"UD0_0TS2" 
"Udo_password2" 

"GSM-GPRS" 

' ' wap . B 2P-operator3 . com' ' 

"APN" 

"ANALOG_MODEM" 

"No" 

"1*10"^" 

"1*10"^" 

"Interactive class" 
"8 kbps" 
"PAP" 

"UD0_0TS1" 
"Udo_passwordl " 

"GSM-GPRS" 

"wap.B2C-operator3.com" 

"APN" 

"ANALOG_MODEM" 

"No" 

"1*10"^" 

"1*10"^" 

"Interactive class" 
"8 kbps" 
"PAP" 

"UD0_0TS2" 
"Udo_password2" 

"170.187.51.5" 

"Ipv4" 

"9201" 

"CO-WSP" 

"HTTP BASIC" 

"gateway_user9" 

"gateway_password9" 
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Coding: AB 
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The UICC is installed into the Terminal and the user hasn't specified a default MMS connectivity parameter set. 

8.3.3.4.2 Procedure 

a) The Terminal is powered on and the PIN shall be entered. 

b) When the Terminal is in idle mode the user shall generate an MM using the MMS User Agent on the Terminal 
with the default MMS connectivity parameter set and send it to "+0123456789". If no MMS Relay/Server is 
available for this parameter set, the next MMS connectivity parameter set offered by the MMS User Agent shall 
be used to send the MM. 

8.3.3.5 Acceptance criteria 

After step b) the Terminal shall have sent the MM to "+0123456789" using the first supported MMS connectivity 
parameter set, which can be used to access an available MMS Relay/Server and is stored in EFmmsicp- 

8.3.4 Usage of MMS notification 

8.3.4.1 Definition and applicability 

An MMS User Agent shall use the MMS related information stored in the USIM, if present, unless otherwise specified 
by the user. This information comprises MMS connectivity information, MMS user preferences and MMS notifications. 
MMS notifications should be stored on the USIM together with an associated status by a MMS User Agent according to 
TS 23.140 [23]. 

8.3.4.2 Conformance requirement 

A Terminal supporting MMS notification storage on the USIM shall store MMS notifications together with an 
associated status on the USIM. 

- TS 31.102 [4], subclauses 4.2.67 and 5.3.29; 

- TS 23.140 [23], subclauses 7.1.12, 7.1.14, 8.1.4 and Annex F. 
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8.3.4.3 Test purpose 

To verify that the Terminal stores and updates MMS notifications with the associated status on the USIM correctly. 

8.3.4.4 Method of test 
8.3.4.4.1 Initial conditions 

Two MMS Relays/Servers are available: 
MMS Relay/Server 1: 

MMS Connectivity Parameters 

MMS implementation information 
MMS Relay/Server 

MMS Relay/Server information: 
Interface to Core Network and Bearer 

Bearer: 

Address: 

Type of address: 

Speed: 

Call type: 

Authentication type: 
Authentication id: 
Authentication pw: 
Gateway 
Address: 
Type of address: 
Port: 
Service: 

Authentication type: 
Authentication id: 
Authentication pw: 



"WAP" 

"http:// mms-operatorl .com " 

"GSM-CSD" 

"+496998625" 

"E164" 

"Autobauding" 

"ANALOG_MODEM" 

"PAP" 

"B2B_0TS1" 
"B2B_passwordl" 

"170.187.51.3" 

"Ipv4" 

"9201" 

"CO-WSP" 

"HTTP BASIC" 

"gateway_userl" 

"gateway_passwordl " 
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MMS Relay/Server 2: 

7) MMS Connectivity Parameters 

MMS implementation information: 
MMS Relay/Server 

MMS Relay/Server information: 
Interface to Core Network and Bearer 

Bearer: 

Address: 

Type of address: 

Call type: 

Delivery of erroneous SDU: 
Residual Bit Error Rate: 
SDU-Error-Ratio: 
Traffic-class: 

Maximum bit rate for downlink: 
Authentication type: 
Authentication id: 
Authentication pw: 
Gateway 
Address: 
Type of address: 
Port: 
Service: 

Authentication type: 
Authentication id: 
Authentication pw: 



"WAP" 

' ' http :// mms-operatorl .com " 

"GSM-GPRS" 
"wap.B2B -operator 1 .com" 
"APN" 

"ANALOG_MODEM" 

"No" 

"1*10"^" 

"1*10"^" 

"Interactive class" 
"8 kbps" 
"PAP" 

"B2B_0TS1" 
"B2B_passwordl" 

"170.187.51.3" 

"Ipv4" 

"9201" 

"CO-WSP" 

"HTTP BASIC" 

"gateway_userl" 

"gateway_passwordl " 



The default UICC is used with the following exceptions: 

EFusT (USIM Service Table) 

Logically: Local Phone Book available 

User controlled PLMN selector available 
Fixed dialling numbers available 
Barred dialling numbers available 
The GSM Access available 

The Group Identifier level 1 and level 2 not available 
SMS available 
SMS Status available 

Service no. 33 (Packed Switched Domain) shall be set to T 
Service no. 52 Multimedia Messaging Service available 
Service no. 53 Extension 8 available 

Service no. 55 MMS User Connectivity Parameters not available 



Coding: 
Binary 



B1 

xx1x xx1 1 



82 

x1 1 X xxxx 



B3 

xxxx 1 xOO 



B4 

xxxx X1 XX 



B5 

xxxx XXX 1 



B6 

xxxx xxxx 



B7 

xOx1 1xxx 



EFi 



MMSN 



Logically: 

MMS Status: 

MMS Implementation : 

MMS Notification: 



Free space 
"00" 

"EE EE ... EE" (251 bytes) 



Extension file record number: "EE" 



Coding: B1 
GO 



B2 
GO 



B3 
GG 



B4 
FF 



B5 
FF 



B254 
FF 



B255 
FF 



EEmmsup 
Logically: 
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MMS Implementation 

MMS implementation information: "WAP" 
MMS User Preference Profile Name: "Greeting cards" 
MMS User Information Preference Information 



Visibility: 
Delivery report: 
Read-reply: 
Priority: 
Delivery-Time: 

Value (absolute): 
Expiry: 

Value (relative): 



"hide" 
"yes" 
"yes" 
"normal" 

"l-Jan-2003, 12:00:00 AM GMT" 
1104537600 seconds 
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EFi 



MMSICP 

Logically: 

MMS Connectivity Parameters 
MMS Implementation 

MMS Implementation Information : 
MMS Relay/Server 

MMS Relay/Server Address 
1^^ Interface to Core Network and Bearer 

Bearer: 

Address: 

Type of address: 

Speed: 

Call type: 

Authentication type: 
Authentication id: 
Authentication pw: 
2"^ Interface to Core Network and Bearer 
Bearer: 
Address: 
Type of address: 
Speed: 
Call type: 

Authentication type: 
Authentication id: 
Authentication pw: 
3^^ Interface to Core Network and Bearer 
Bearer: 
Address: 
Type of address: 
Call type: 

Delivery of erroneous SDU: 
Residual Bit Error Rate: 



"WAP" 

"http:// mms-operatorl .com " 

"GSM-CSD" 

"+496998625" 

"E164" 

"Autobauding" 

"ANALOG_MODEM" 

"PAP" 

"B2B_0TS1" 
"B2B_passwordl " 

"GSM-CSD" 

"+496998626" 

"E164" 

"Autobauding" 

"ANALOG_MODEM" 

"PAP" 

"B2C_OTS2" 
"B2C_password2" 

"GSM-GPRS" 

' ' wap . B 2B -operator 1 . com' ' 

"APN" 

"ANALOG_MODEM" 

"No" 

"1*10"^" 
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SDU-Error-Ratio: 
Traffic-class: 

Maximum bit rate for downlink: 
Authentication type: 
Authentication id: 
Authentication pw: 
4* Interface to Core Network and Bearer 
Bearer: 
Address: 
Type of address: 
Call type: 

Delivery of erroneous SDU: 
Residual Bit Error Rate: 
SDU-Error-Ratio: 
Traffic-class: 

Maximum bit rate for downlink: 
Authentication type: 
Authentication id: 
Authentication pw: 
Gateway: 
Address: 
Type of address: 
Port: 
Service: 

Authentication type: 
Authentication id: 
Authentication pw: 



"Interactive class" 
"8 kbps" 
"PAP" 

"B2B_0TS1" 
"B2B_passwordl" 

"GSM-GPRS" 

" wap.B2C-operator 1 .com" 

"APN" 

"ANALOG_MODEM" 

"No" 
"1*10"^" 

"Interactive class" 
"8 kbps" 
"PAP" 

"B2C_OTS2" 
"B2C_password2" 

"170.187.51.3" 

"Ipv4" 

"9201" 

"CO-WSP" 

"HTTP BASIC" 

"gateway_userl" 

" gate way_pas sword 1 " 
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1A 


67 


61 


74 


65 


77 


61 


79 


11 


75 


73 


65 


72 


31 


00 


IB 


67 


61 


74 


65 


77 


61 


79 


11 


70 


61 


73 


73 


77 


6F 


72 


64 


31 


00 













EFexts 



Logically: 

At least 10 records. 

Record 1 to 10: Free space with 253 bytes for extension data 

Record 1: 
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Coding: B1 B2 B3 B4 B255 

Hex 00 FF FF FF FF 

The UICC is installed into the Terminal and the user hasn't specified a default MMS connectivity parameter set. 

8.3.4.4.2 Procedure 

a) The terminal is powered on and the PIN shall be entered. 

b) When the terminal is in idle mode a MM shall be sent to the terminal via the MMS Relay/Server 1 or 2, 
dependent on the bearer supported by the terminal. This MMS Relay/Server shall then generate a notification to 
the Terminal's MMS User Agent. With the MM notification the MMS User Agent shall receive a message 
reference that can be used for retrieving the MM from this MMS Relay/Server. 

The MM shall result in a MMS notification with the following predefined values: 

X-Mms Message Type: "m-notification-ind" (0x82) 

X-Mms-Transaction-ID: "01" 

X-Mms-MMS-Version: " 1 .0" 

From: not present (hidden) 

Subject: "MM for you" 

X-Mms-Content-Location: "http://mms-operatorl/MMBox/ID-007-12345678" 

c) The user shall read the MMS notification stored on the USIM. 

d) The user shall retrieve the MM stored on the MMS Relay/Server used in step b). 

e) The user shall forward the MM to "+0123456789" using the default MMS Issuer Connectivity Parameters 
stored on the USIM. 

f) A MM shall be sent to the terminal via the same MMS Relay/Server as in step b). This MMS Relay/Server shall 
then generate a notification to the Terminal's MMS User Agent. With the MM notification the MMS User 
Agent shall receive a message reference that can be used for retrieving the MM from this MMS Relay/Server. 

The MM shall result in a MMS notification with the following predefined values: 

X-Mms Message Type: "m-notification-ind" (0x82) 

X-Mms-Transaction-ID: "02" 

X-Mms-MMS- Version: " 1 .0" 

From: "+0987123654" 

Subject: "Urgent MM" 

X-Mms-Content-Location: "http://mms-operatorl/MMBox/ID-007-02468024" 

g) The user shall read the MMS notification stored on the USIM. 

h) The user shall reject the MM stored on the MMS Relay/Server used in step b). 

8.3.4.5 Acceptance criteria 

1) After step b) the MMS User Agent on the terminal shall have stored the MMS notification on the USIM with the 
values defined in step b) of 8.4.4.4.2, the associated status shall have been set to "Used space, notification not 
read, MM not retrieved" and the MMS User Agent shall indicate to the user that a MMS notification has been 
received. 
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2) After step c) the status of the MMS notification stored on the USIM shall have been set to "used space, 
notification read, MM not retrieved". 

3) After step d) the MMS user agent shall have retrieved the MM from the MMS Relay/Server 1 and the status of 
the MMS notification stored on the USIM shall have either been set to "used space, notification read, MM 
retrieved" or the MMS notification shall have been deleted and the associated shall have been set to "Free 
space". 

4) After step e) the terminal shall have read the set of MMS Issuer Connectivity Parameters stored first in EFmmsicp 
and shall have forward the MM to "+0123456789" using the MMS Relay/Server 1. The MMS notification shall 
have either been set to "used space, notification read, MM forwarded" or the MMS notification shall have been 
deleted and the associated shall have been set to "Free space". 

5) After step f) the MMS User Agent on the terminal shall have stored the MMS notification on the USIM with the 
values defined in step f) of 8.4.4.4.2, the associated status shall have been set to "Used space, notification not 
read, MM not retrieved" and the MMS User Agent shall indicate to the user that a MMS notification has been 
received. 

6) After step g) the status of the MMS notification stored on the USIM shall have been set to "used space, 
notification read, MM not retrieved". 

7) After step h) the MMS user agent shall have not retrieved the MM from the MMS Relay/Server 1 and the status 
of the MMS notification stored on the USIM shall have either been set to "used space, notification read, MM 
rejected" or the MMS notification shall have been deleted and the associated shall have been set to "Free space". 



To ensure that the UICC has not been removed during a card session, the Terminal sends in case of inactivity on the 
UICC-Terminal interface, at frequent intervals, a STATUS command during each call. 

This procedure shall be used in addition to a mechanical or other devices used to detect the removal of a UICC. 

8.4.2 Conformance requirement 

A STATUS command shall be issued within all 30 second periods of inactivity on the UICC-Terminal interface during 
a call. Inactivity in this case is defined as starting at the end of the last communication or the last issued STATUS 
conmiand. If no response data is received to this STATUS command, then the call shall be terminated as soon as 
possible but at least within 5s after the STATUS command has been sent. If the DF indicated in response to a STATUS 
command is not the same as that which was indicated in the previous response, or accessed by the previous command, 
then the call shall be terminated as soon as possible but at least within 5 seconds after the response data has been 
received. 

- TS 31.102 [4], subclauses 5.1.9 

- ETSI TS 102 221 [5], clause 14.5.2. 

8.4.3 Test purpose 

1) To verify that there are no periods of inactivity on the UICC-Terminal interface greater than 30 seconds during a 
call. 

2) To verify that the terminal terminates a call within 5 s at the latest after having received an invalid response to 
the STATUS conmiand. 



8.4 



UICC presence detection 



8.4.1 



Definition and applicability 
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8.4.4 Method of test 

8.4.4.1 Initial conditions 

The terminal shall be connected to the UICC simulator. All elementary files shall be coded as default. 

8.4.4.2 Procedure 

a) A call shall be set up using the generic call setup. 

b) The UICC simulator shall monitor the time of periods of inactivity on the UICC-Terminal interface. 

c) After 3 minutes, the call shall be cleared. 

d) A call shall be set up using the generic call setup. 

e) After one minute after the call was successfully set up, the UICC simulator shall respond to a STATUS 
command with the response data indicating a DF different from the current DF. 

8.4.5 Acceptance criteria 

1) During step b), the time of periods of inactivity on the UICC-Terminal interface shall not be longer than 30 
seconds. 

2) After step e), the Terminal shall terminate the call within 5 s at the latest after having received the wrong 
response to the STATUS command. 

8.5 UICC presence detection when connected to E- 
UTRAN/EPC 

8.5.1 Definition and applicability 

To ensure that the UICC has not been removed during a card session, the Terminal sends in case of inactivity on the 
UICC-Terminal interface, at frequent intervals, a STATUS conmiand during each call or active PDP context. 

8.5.2 Conformance requirement 

A STATUS command shall be issued within all 30 second periods of inactivity on the UICC-Terminal interface during 
an active PDP context. Inactivity in this case is defined as starting at the end of the last communication or the last issued 
STATUS conmiand. If no response data is received to this STATUS conmiand, then the active PDP context shall be 
terminated as soon as possible but at least within 5s after the STATUS command has been sent. If the DF indicated in 
response to a STATUS command is not the same as that which was indicated in the previous response, or accessed by 
the previous command, then the active PDP context shall be terminated as soon as possible but at least within 5 seconds 
after the response data has been received. . 

There is 1:1 mapping between one PDP context and one EPS Bearer. 

- TS 31.102 [4], subclauses 5.1.9 

- ETSI TS 102 221 [5], clause 14.5.2. 

- TS 23.060 [25], subclause 9.2.1 A. 

8.5.3 Test purpose 

1) To verify that there are no periods of inactivity on the UICC-Terminal interface greater than 30 seconds during 
an active PDP context. 
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2) To verify that the terminal terminates the default EPS Bearer within 5 s at the latest after having received an 
invalid response to the STATUS conmiand. 

8.5.4 Method of test 

8.5.4.1 Initial conditions 

The terminal is connected to the USIM Simulator and the E-USS. 
The default E-UTRAN UICC is used. 

8.5.4.2 Procedure 

a) The terminal is switched on, performs the Attach procedure to the E-USS and establishes the default EPS bearer. 

b) The UICC simulator shall monitor the time of periods of inactivity on the UICC-Terminal interface. 

c) Step b) shall be performed for 3 minutes. 

d) After one minute after the end of step c), the UICC simulator shall respond to a STATUS conmiand with the 
response data indicating a DF different from the current DF. 

8.5.5 Acceptance criteria 

1) During step c), the time of periods of inactivity on the UICC-Terminal interface shall not be longer than 30 
seconds. 

2) After step d), the Terminal shall terminate the default EPS bearer within 5 s at the latest after having received the 
wrong response to the STATUS command. 

9 USIM service handling 

9.1 Access Point Name Control List handling 

9.1 .1 Access Point Name Control List handling for terminals supporting 
ACL 

9.1 .1 .1 Definition and applicability 

This EFacl contains the Hst of allowed APNs (Access Point Names). When the APN Control List service is enabled, the 
ME shall check that the entire APN of any PDP context is listed in EFacl before requesting this PDP context activation 
from the network. If the APN is not present in EFacl? the ME shall not request the corresponding PDP context 
activation from the network. 

9.1 .1 .2 Conformance requirement 

The terminal shall support the APN Control List service as defined in TS 31.102 [4], subclauses 5.1.1.2 and 5.3.14. 
Reference: 

- TS 31.102 [4], subclauses 4.2.8, 4.2.48, 5.1.1.2 and 5.3.14; 

- TS 23.060 [25], subclause 9.2. 
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1) To verify that the terminal takes into account the status of the APN Control List service as indicated in EFust 
and EFest- 

2) To verify that the terminal checks that the entire APN of any PDP context is listed in EFacl before requesting 
this PDP context activation from the network if the ACL service is enabled. 

3) To verify that the terminal does not request the corresponding PDP context activation from the network if the 
ACL service is enabled and the APN is not present in EFacl- 



9.1.1.4 



Method of test 



9.1.1.4.1 Initial conditions 

The terminal is connected to the USIM Simulator and the (U)SS. 
The default USIM is used with the following exceptions: 

The APN Control List (ACL) shall be allocated and activated in the USIM Service Table and enabled in the Enabled 
Service Table. 

EFacl shall be present with the following values: 

EFacl (Access Point Control List) 

Logically: Number of available bytes: 64 

Number of APNs: 3 



Byte: 
Coding: 





V APN: 




test.test 


















2"^ APN: 




3gpp.test 
















3'^ APN: 




2gpp.test 














B1 


B2 


B3 


B4 


B5 


B6 


B7 


B8 


B9 


B10 


B11 


03 


DD 


OA 


04 


74 


65 


73 


74 


04 


74 


65 


B13 


B14 


B15 


B16 


B17 


B18 


B19 


B20 


B21 


B22 


B23 


74 


DD 


OA 


04 


33 


67 


70 


70 


04 


74 


65 


B25 


B26 


B27 


B28 


B29 


B30 


B31 


B32 


B33 


B34 


B35 


74 


DD 


OA 


04 


32 


67 


70 


70 


04 


74 


65 


B37 


B38 




B64 
















74 


FF 




FF 

















B1 
73 



9.1.1.4.2 



Procedure 



a) The terminal is switched on and the USIM application shall be activated. 

b) The user shall request a PDP context activation to " Igpp.test". 

c) The user shall request a PDP context activation to "3gpp.test". 

d) The user shall deactivate the PDP context. 

e) The user shall disable the APN Control List service. When prompted to enter PIN2, the user shall present the 
correct PIN2 value. 

f) The user shall request a PDP context activation to "Igpp.test". 

g) The user shall deactivate the PDP context and shall switch the terminal off and then switch on again. 

h) The user shall enable the APN Control List service. When prompted to enter PIN2, the user shall present the 
correct PIN2 value. 

i) The user shall request a PDP context activation to " lppp.net". 
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j) The terminal is switched off and on. 

k) The user shall add the APN "lppp.net" to the APN Control List. When prompted to enter PIN2, the user shall 
present the correct PIN2 value. 

1) The user shall request a PDP context activation to " lppp.net". 

m) The user shall deactivate the PDP context and switch off the terminal. 

9.1 .1 .5 Acceptance criteria 

1) After step a) the terminal shall have activated the USIM application, shall have read the status of the ACL 
service in EFust and EFest and be in updated idle mode on the (U)SS. 

2) The terminal shall have not requested a PDP context activation in step b). 

3) After step c) the PDP context shall have been activated. 

4) After step d) the PDP context shall have been deactivated. 

5) After step e) the APN Control List service shall have been set to disabled in EFest- 

6) After step f) the PDP context shall have been activated. 

7) After step g) the PDP context shall have been deactivated. 

8) After step h) the APN Control List service shall have been set to enabled in EFest- 

9) The terminal shall not have requested a PDP context activation in step i). 

10) After step k) the APN "lppp.net" shall have been added to the APN Control List in EFacl- 

1 1) After step 1) the PDP context shall have been activated. 

9.1 .2 Network provided APN handling for terminals supporting ACL 

9.1 .2.1 Definition and applicability 

This EFacl contains the list of allowed APNs (Access Point Names). When the APN Control List service is enabled, the 
ME shall check that the entire APN of any PDP context is listed in EFacl before requesting this PDP context activation 
from the network. If the APN is not present in EFacl? the ME shall not request the corresponding PDP context 
activation from the network. 

In the case that the APN Control List is enabled and no APN is indicated in the PDP context request, indicating that a 
network provided APN is to be used, then the ME shall only request the PDP context activation if "network provided 
APN" is contained within EFacl- 

9.1 .2.2 Conformance requirement 

The terminal shall support the APN Control List service as defined in TS 31.102 [4], subclauses 5.1.1.2 and 5.3.14. 
Reference: 

- TS 31.102 [4], subclauses 4.2.8, 4.2.48, 5.1.1.2 and 5.3.14; 

- TS 23.060 [25], subclause 9.2. 

9.1.2.3 Test purpose 

1) To verify that if ACL is enabled and if no APN is indicated in the PDP context the terminal request the PDP 
context activation only if "network provided APN" is contained within EFacl- 

2) To verify that the user is able to set an APN in EFacl entry to the value "network provided APN". 
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3) To verify that the minimum set of APN entries in EFacl is ensured when the user deletes APN entries. 



9.1.2.4 Method of test 



9.1 .2.4.1 Initial conditions 

The terminal is connected to the USIM Simulator and the (U)SS. 
The default USIM is used with the following exceptions: 

The APN Control List (ACL) shall be allocated and activated in the USIM Service Table and enabled in the Enabled 
Service Table. 



EFacl shall be present with the following values: 

EFacl (Access Point Control List) 

Logically: Number of available bytes: 64 

Number of APNs: 3 
1'^ APN: test.test 
2^^ APN: Sgpp.test 
3'^ APN: 2gpp.test 



Byte: 


B1 


B2 


B3 


B4 


B5 


B6 


B7 


B8 


B9 


B10 


B11 


B12 


Coding: 


03 


DD 


OA 


04 


74 


65 


73 


74 


04 


74 


65 


73 




B13 


B14 


B15 


B16 


B17 


B18 


B19 


B20 


B21 


B22 


B23 


B24 




74 


DD 


OA 


04 


33 


67 


70 


70 


04 


74 


65 


73 



B25 
74 



B26 
DD 



B27 
OA 



B28 
04 



B29 
32 



B30 
67 



B31 
70 



B32 
70 



B33 
04 



B34 
74 



B35 
65 



B36 
73 



B37 
74 



B38 
FF 



B64 
FF 



9.1.2.4.2 Procedure 

a) The terminal is switched on and the USIM application shall be activated. 

b) The user shall add "network provided APN" to the APN Control List in EFacl by using an MMI dependent 
option in the terminal. When prompted to enter PIN2, the user shall present the correct PIN2 value. 

c) The user shall request a PDP context activation to "3gpp.test". 

d) The user shall deactivate the PDP context. 

e) The user shall request a PDP context activation without indicating an APN. 

f) The user shall deactivate the PDP context. 

g) The user shall delete "network provided APN" from the APN Control List in EFacl by using an MMI dependent 
option in the terminal. When prompted to enter PIN2, the user shall present the correct PIN2 value. 

h) The user shall request a PDP context activation to "3gpp.test". 

i) The user shall deactivate the PDP context. 

j) The user shall request a PDP context activation without indicating an APN. 

k) The user shall try to delete all APNs from the APN Control List in EFacl by using an MMI dependent option in 
the terminal. When the terminal indicates that at least one APN entry shall remain, the user shall set this entry to 
"network provided APN". When prompted to enter PIN2, the user shall present the correct PIN2 value. 

1) The user shall switch off the terminal. 



ETSI 



3GPP TS 31.121 version 10.2.1 Release 10 



260 



ETSI TS 131 121 VI 0.2.1 (2011-11) 



9.1.2.5 Acceptance criteria 

1) After step a) the terminal shall have activated the USIM application, shall have read the status of the ACL 
service in EFust and EFest and be in updated idle mode on the (U)SS. 

2) After step b) EFacl shall contain an entry for "network provided APN". 

3) After step c) the PDP context shall have been activated. 

4) After step d) the PDP context shall have been deactivated. 

5) After step e) the PDP context shall have been activated. 

6) After step f) the PDP context shall have been deactivated. 

7) After step g) EFacl shall not contain an entry for "network provided APN". 

8) After step h) the PDP context shall have been activated. 

9) After step i) the PDP context shall have been deactivated. 

10) The terminal shall have not requested a PDP context activation in step j). 

1 1) After step k) EFacl shall contain one APN entry with the value "network provided APN" and the corresponding 
number of APNs in EFacl shall be 1 . 

9.1 .3 Access Point Name Control List handling for terminals not 
supporting ACL 

9.1 .3.1 Definition and applicability 

This EFacl contains the list of allowed APNs (Access Point Names). When the APN Control List service is enabled, the 
ME shall check that the entire APN of any PDP context is listed in EFacl before requesting this PDP context activation 
from the network. If the APN is not present in EFacl, the ME shall not request the corresponding PDP context 
activation from the network. 

If ACL is enabled, an ME which does not support ACL shall not send any APN to the network. 

9.1 .3.2 Conformance requirement 

An ME which does not support ACL shall not send any APN to the network if ACL is enabled. 
Reference: 

- TS 31.102 [4], 5.1.1.2. 

9.1.3.3 Test purpose 

To verify that if ACL is enabled, an ME which does not support ACL, does not send any APN to the network to 
request a PDP context activation. 9. 1 .3 .4 Method of test 

9.1.3.4 Method of test 
9.1 .3.4.1 Initial conditions 

The terminal is connected to the USIM Simulator and the (U)SS. 
The default USIM is used with the following exceptions: 

The APN Control List (ACL) shall be allocated and activated in the USIM Service Table and enabled in the Enabled 
Service Table. 
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EFacl shall be present with the following values: 

EFacl (Access Point Control List) 

Logically: Number of available bytes: 64 

Number of APNs: 3 
1'* APN: test.test 
2"^ APN: Sgpp.test 
3'^ APN: 2gpp.test 



Byte: 


B1 


B2 


B3 


B4 


B5 


B6 


B7 


B8 


B9 


B10 


B11 


B12 


Coding: 


03 


DD 


OA 


04 


74 


65 


73 


74 


04 


74 


65 


73 




B13 


B14 


B15 


B16 


B17 


B18 


B19 


B20 


B21 


B22 


B23 


B24 




74 


DD 


OA 


04 


33 


67 


70 


70 


04 


74 


65 


73 




B25 


B26 


B27 


B28 


B29 


B30 


B31 


B32 


B33 


B34 


B35 


B36 




74 


DD 


OA 


04 


32 


67 


70 


70 


04 


74 


65 


73 



B37 B38 ... B64 
74 FF ... FF 



9.1.3.4.2 Procedure 

a) The terminal is switched on and the USIM application shall be activated. 

b) The user shall request a PDP context activation to "3gpp.test". 

c) The terminal shall be switched off. 

9.1.3.5 Acceptance criteria 

1) After step a) the terminal shall have activated the USIM application, shall have read the status of the ACL 
service in EFust and EFest and be in updated idle mode on the (U)SS. 

2) The terminal shall not have sent any APN to the network in step b). 

9.1 .4 Access Point Name Control List handling for terminals supporting 
ACL connected to E-UTRAN/EPC 

9.1 .4.1 Definition and applicability 

This EFacl contains the list of allowed APNs (Access Point Names). When the APN Control List service is enabled, the 
ME shall check that the entire APN of any PDP context is listed in EFacl before requesting this PDP context activation 
from the network. If the APN is not present in EFacl? the ME shall not request the corresponding PDP context 
activation from the network. 

There is 1:1 mapping between one PDP context and one EPS Bearer. 

9.1 .4.2 Conformance requirement 

The terminal shall support the APN Control List service as defined in TS 31.102 [4], subclauses 5.1.1.2 and 5.3.14. 
Reference: 

- TS 31.102 [4], subclauses 4.2.8, 4.2.48, 5.1.1.2 and 5.3.14; 

- TS 23.060 [25], subclause 9.2, 9.2.1 A. 
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1) To verify that the terminal takes into account the status of the APN Control List service as indicated in EFust 
and EFest- 

2) To verify that the terminal checks that the entire APN of any EPS Bearer is listed in EFacl before requesting this 
EPS Bearer activation from the network if the ACL service is enabled. 

3) To verify that the terminal does not request the corresponding EPS Bearer activation from the network if the 
ACL service is enabled and the APN is not present in EFacl- 



9.1.4.4 



Method of test 



9.1 .4.4.1 Initial conditions 

The terminal is connected to the USIM Simulator and the E-USS. 
The default E-UTRAN UICC is used with the following exceptions: 

The APN Control List (ACL) shall be allocated and activated in the USIM Service Table and enabled in the Enabled 
Service Table. 

EFacl shall be present with the following values: 

EFacl (Access Point Control List) 

Logically: Number of available bytes: 64 

Number of APNs: 3 



Byte: 
Coding: 





V APN: 




test.test 




















2"^ APN: 




3gpp.test 


















3'^ APN: 




2gpp.test 
















B1 


B2 


B3 


B4 


B5 


B6 


B7 


B8 


B9 


B10 


B11 


B12 


03 


DD 


OA 


04 


74 


65 


73 


74 


04 


74 


65 


73 


B13 


B14 


B15 


B16 


B17 


B18 


B19 


B20 


B21 


B22 


B23 


B24 


74 


DD 


OA 


04 


33 


67 


70 


70 


04 


74 


65 


73 


B25 


B26 


B27 


B28 


B29 


B30 


B31 


B32 


B33 


B34 


B35 


B36 


74 


DD 


OA 


04 


32 


67 


70 


70 


04 


74 


65 


73 


B37 


B38 




B64 


















74 


FF 




FF 



















9.1.4.4.2 



Procedure 



a) The terminal is switched on and the USIM application shall be activated. 

b) The user shall request PDN connectivity to " Igpp.test". 

c) The user shall request PDN connectivity to "3gpp.test". 

d) The user shall deactivate the PDN connectivity to "3gpp.test". 

e) The user shall disable the APN Control List service. When prompted to enter PIN2, the user shall present the 
correct PIN2 value. 

f) The user shall request PDN connectivity to " Igpp.test". 

g) The user shall deactivate the PDN connectivity to " Igpp.test" and shall switch the terminal off and then switch 
on again. 

h) The user shall enable the APN Control List service. When prompted to enter PIN2, the user shall present the 
correct PIN2 value. 
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i) The user shall request PDN connectivity to " lppp.net". 
j) The terminal is switched off and on. 

k) The user shall add the APN " lppp.net" to the APN Control List. When prompted to enter PIN2, the user shall 
present the correct PIN2 value. 

1) The user shall request PDN connectivity to " lppp.net". 

m) The user shall deactivate the PDN connectivity and switch off the terminal. 

9.1.4.5 Acceptance criteria 

1) After step a) the terminal shall have activated the USIM application, shall have read the status of the ACL 
service in EFust and EFest and be in updated idle mode on the E-USS. 

2) The terminal shall have not requested PDN connectivity in step b). 

3) After step c) PDN connectivity shall have been activated. 

4) After step d) PDN connectivity shall have been deactivated. 

5) After step e) the APN Control List service shall have been set to disabled in EFest- 

6) After step f) PDN connectivity shall have been activated. 

7) After step g) PDN connectivity shall have been deactivated. 

8) After step h) the APN Control List service shall have been set to enabled in EFest- 

9) The terminal shall not have requested PDN connectivity in step i). 

10) After step k) the APN "lppp.net" shall have been added to the APN Control List in EFacl- 

1 1) After step 1) PDN connectivity shall have been activated. 



9.1 .5 Network provided APN handling for terminals supporting ACL 
connected to E-UTRAN/EPC 



This EFacl contains the list of allowed APNs (Access Point Names).When the APN Control List service is enabled, the 
ME shall check that the entire APN of any PDP context is listed in EFacl before requesting this PDP context activation 
from the network. If the APN is not present in EFacl. the ME shall not request the corresponding PDP context 
activation from the network. 

In the case that the APN Control List is enabled and no APN is indicated in the PDP context request, indicating that a 
network provided APN is to be used, then the ME shall only request the PDP context activation if "network provided 
APN" is contained within EFacl- 

There is 1:1 mapping between one PDP context and one EPS Bearer. 



The terminal shall support the APN Control List service as defined in TS 31.102 [4], subclauses 5.1.1.2 and 5.3.14. 
Reference: 

- TS 31.102 [4], subclauses 4.2.8, 4.2.48, 5.1.1.2 and 5.3.14; 

- TS 23.060 [25], subclause 9.2, 9.2.1 A. 



9.1.5.1 



Definition and applicability 



9.1.5.2 



Conformance requirement 
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9.1.5.3 Test purpose 

1) To verify that if ACL is enabled and if no APN is indicated in the EPS Bearer the terminal request the EPS 
Bearer activation only if "network provided APN" is contained within EFacl- 

2) To verify that the user is able to set an APN in EFacl entry to the value "network provided APN". 

3) To verify that the minimum set of APN entries in EFacl is ensured when the user deletes APN entries. 

9.1.5.4 Method of test 



9.1 .5.4.1 Initial conditions 

The terminal is connected to the USIM Simulator and the E-USS. 
The default E-UTRAN UICC is used with the following exceptions: 

The APN Control List (ACL) shall be allocated and activated in the USIM Service Table and enabled in the Enabled 
Service Table. 



EFacl shall be present with the following values: 

EFacl (Access Point Control List) 

Logically: Number of available bytes: 64 

Number of APNs: 3 
1'^ APN: test.test 
2"^ APN: Sgpp.test 
3'^ APN: 2gpp.test 



Byte: 


B1 


B2 


B3 


B4 


B5 


B6 


B7 


B8 


B9 


B10 


B11 


Coding: 


03 


DD 


OA 


04 


74 


65 


73 


74 


04 


74 


65 




B13 


B14 


B15 


B16 


B17 


B18 


B19 


B20 


B21 


B22 


B23 




74 


DD 


OA 


04 


33 


67 


70 


70 


04 


74 


65 



B1 
73 



B25 
74 



B26 
DD 



B27 
OA 



B28 
04 



B29 
32 



B30 
67 



B31 
70 



B32 
70 



B33 
04 



B34 
74 



B35 
65 



73 



B37 
74 



B38 
FF 



B64 
FF 



9.1.5.4.2 Procedure 

a) The terminal is switched on and the USIM application shall be activated. 

b) The user shall add "network provided APN" to the APN Control List in EFacl by using an MMI dependent 
option in the terminal. When prompted to enter PIN2, the user shall present the correct PIN2 value. 

c) The user shall request PDN connectivity to "3gpp.test". 

d) The user shall deactivate the PDN connectivity to "3gpp.test". 

e) The user shall request PDN connectivity without indicating an APN. 

f) The user shall deactivate the PDP context. 

g) The user shall delete "network provided APN" from the APN Control List in EFacl by using an MMI dependent 
option in the terminal. When prompted to enter PIN2, the user shall present the correct PIN2 value. 

h) The user shall request PDN connectivity to "3gpp.test". 

i) The user shall deactivate the PDN connectivity to "3gpp.test". 

j) The user shall request PDN connectivity without indicating an APN. 
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k) The user shall try to delete all APNs from the APN Control List in EFacl by using an MMI dependent option in 
the terminal. When the terminal indicates that at least one APN entry shall remain, the user shall set this entry to 
"network provided APN". When prompted to enter PIN2, the user shall present the correct PIN2 value. 

1) The user shall switch off the terminal. 

9.1 .5.5 Acceptance criteria 

1) After step a) the terminal shall have activated the USIM application, shall have read the status of the ACL 
service in EFust and EFest and be in updated idle mode on the E-USS. 

2) After step b) EFacl shall contain an entry for "network provided APN". 

3) After step c) PDN connectivity shall have been activated. 

4) After step d) PDN connectivity shall have been deactivated. 

5) After step e) PDN connectivity shall have been activated. 

6) After step f) PDN connectivity shall have been deactivated. 

7) After step g) EFacl shall not contain an entry for "network provided APN". 

8) After step h) PDN connectivity shall have been activated. 

9) After step i) PDN connectivity shall have been deactivated. 

10) The terminal shall have not requested PDN connectivity in step j). 

1 1) After step k) EFacl shall contain one APN entry with the value "network provided APN" and the corresponding 
number of APNs in EFacl shall be 1 . 

9.1 .6 Access Point Name Control List handling for terminals not 
supporting ACL connected to E-UTRAN/EPC 

9.1 .6.1 Definition and applicability 

This EFacl contains the list of allowed APNs (Access Point Names). When the APN Control List service is enabled, the 
ME shall check that the entire APN of any PDP context is listed in EFacl before requesting this PDP context activation 
from the network. If the APN is not present in EFacl? the ME shall not request the corresponding PDP context 
activation from the network. 

If ACL is enabled, an ME which does not support ACL shall not send any APN to the network. 
There is 1:1 mapping between one PDP context and one EPS Bearer. 

9.1 .6.2 Conformance requirement 

An ME which does not support ACL shall not send any APN to the network if ACL is enabled. 
Reference: 

- TS 31.102 [4], 5.1.1.2. 

- TS 23.060 [25], 9.2.1 A. 

9.1.6.3 Test purpose 

To verify that if ACL is enabled, an ME which does not support ACL, does not send any APN to the network to 
request an EPS Bearer activation. 
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9.1.6.4 Method of test 
9.1 .6.4.1 Initial conditions 

The terminal is connected to the USIM Simulator and the E-USS. 
The default E-UTRAN UICC is used with the following exceptions: 

The APN Control List (ACL) shall be allocated and activated in the USIM Service Table and enabled in the Enabled 
Service Table. 

EFacl shall be present with the following values: 

EFacl (Access Point Control List) 

Logically: Number of available bytes: 64 

Number of APNs: 3 



1'^ APN: test.test 
2"^ APN: Sgpp.test 
3'^ APN: 2gpp.test 



Byte: 


B1 


B2 


B3 


B4 


B5 


B6 


B7 


B8 


B9 


B10 


B11 


Coding: 


03 


DD 


OA 


04 


74 


65 


73 


74 


04 


74 


65 




B13 


B14 


B15 


B16 


B17 


B18 


B19 


B20 


B21 


B22 


B23 




74 


DD 


OA 


04 


33 


67 


70 


70 


04 


74 


65 




B25 


B26 


B27 


B28 


B29 


B30 


B31 


B32 


B33 


B34 


B35 




74 


DD 


OA 


04 


32 


67 


70 


70 


04 


74 


65 



B37 B38 ... B64 
74 FF ... FF 



9.1.6.4.2 Procedure 

a) The terminal is switched on and the USIM application shall be activated. 

b) The user shall request PDN connectivity to "3gpp.test". 

c) The terminal shall be switched off. 

9.1.6.5 Acceptance criteria 

1) After step a) the terminal shall have activated the USIM application, shall have read the status of the ACL 
service in EFust and EFest and be in updated idle mode on the E-USS. 

2) The terminal shall not have sent any APN to the network in step b). 



9.2 Service Dialling Numbers handling 
9.2.1 Definition and applicability 

The Service Dialling Numbers feature allows for the storage of numbers related to services offered by the network 
operator/service provider in the SIM/USIM (e.g. customer care). The user can use these telephone numbers to make 
outgoing calls, but the access for updating of the numbers shall be under the control of the operator. 
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9.2.2 Conformance requirement 

The terminal shall support the Service Dialling Numbers service as defined in TS 31.102 [4], subclauses 4.2.8 and 
4.2.29. 

Reference: 

- TS 31.102 [4], subclauses 4.2.8, 4.2.29 and 4.2.31; 

- TS 22.101 [11], subclause A.23. 

9.2.3 Test purpose 

1) To verify that the terminal takes into account the status of the Service Dialling Numbers service as indicated in 
EFusT- 

2) To verify that the user can use the Service Dialling Numbers to make outgoing calls. 

3) To verify that the terminal is able to handle SDNs with an extended dialling number string. 

4) To verify that the terminal is able to handle an empty alpha identifier in EFsdn- 

5) To verify that the terminal is able to handle an alpha identifier of maximum length in EFsdn- 

9.2.4 Method of test 
9.2.4.1 Initial conditions 

The terminal is connected to the USIM Simulator and the (U)SS. 
The default USIM is used with the following exceptions: 

The Service Dialling Numbers (SDN) shall be allocated and activated in the USIM Service Table. 
EFsdn shall be present with the following values: 
EFsdn (Service Dialling Numbers) 

Logically: 

6 records, 1 record shall be empty. Unless otherwise stated, the SDN records shall not use extendend BCD 
numbers/SSC strings. Access to update EFsdn shall be granted by usage of ADMl only. 

Record 1: Length of alpha identifier: 241 characters; 

Alpha identifier: 

"Hotline001122334455667788ABCDEFGHIJKLMNOPQRSTUVW 
XYZ0123456789abcdefghijklmnopqrstuvwxyz0123456789ABCDEF 
GHIJKLMNOPQRSTUVWXYZO 1 23456789abcdefghijklmnopqrstuv 
wxyzO 1 234567 89 AB CDEFGHI JKLMNOPQRSTUVWXYZO 1 23456 
789abcdefghijklmnopqrstuvwxyz0123456789"; 
Length of BCD number: 5; 

TON and NPI: Telephony and International; 

Dialled number: "22223333"; 
CCP: 'FF'; 
Ext3: 'FF'. 

Record 1: 
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Onrlinn" 


B1 


82 


B3 


B4 


B5 


Hex 


48 


6F 


74 


6C 


69 




B241 


B242 


B243 


B244 


B245 




39 


05 


91 


22 


22 




B253 


B254 


B255 








FF 


FF 


FF 







B6 


B7 


B8 


B9 


B10 


B11 


6E 


65 


30 


30 


31 




B246 


B247 


B248 


B249 


B250 


B251 


33 


33 


FF 


FF 


FF 


FF 



Record 2: 



Length of alpha identifier: 241 characters; 



Alpha identifier: 
Length of BCD number: 
TON and NPL 
Dialled number: 
CCI2: 
Ext3: 



"Hotline002"; 
5; 

Telephony and International; 

"44554455"; 

'FF'; 

'FF'. 



Record 2: 



Coding: 


B1 


B2 


B3 


B4 


B5 


B6 


B7 


B8 


B9 


BIO 


B11 


Hex 


48 


6F 


74 


6C 


69 


6E 


65 


30 


30 


32 


FF 




B241 


B242 


B243 


B244 


B245 


B246 


B247 


B248 


B249 


B250 


B251 




FF 


05 


91 


44 


55 


44 


55 


FF 


FF 


FF 


FF 



B253 B254 B255 
FF FF FF 



Record 3: 



Length of alpha identifier: 241 characters; 



Alpha identifier: 
Length of BCD number: 
TON and NPL 
Dialled number: 
CCI2: 
Ext3: 



"Hotline003"; 

11; 

Telephony and International; 

"01234567890123456789"; 

'FF'; 

"01". 



Record 3: 



Coding: 


B1 


B2 


B3 


B4 


B5 


B6 


B7 


B8 


B9 


BIO 


B11 


Hex 


48 


6F 


74 


6C 


69 


6E 


65 


30 


30 


33 


FF 




B241 


B242 


B243 


B244 


B245 


B246 


B247 


B248 


B249 


B250 


B251 




FF 


OB 


91 


10 


32 


54 


76 


98 


10 


32 


54 



B252 
76 



B253 B254 B255 
98 FF 01 



Record 4: 



Length of alpha identifier: 241 characters; 



Alpha identifier: 
Length of BCD number: 
TON and NPI: 
Dialled number: 
CCI2: 
Ext3: 



empty; 
03; 

Telephony and International; 

"007"; 

'FF'; 

'FF'. 



Record 4: 
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Onrlinn" 


B1 


82 


B3 


B4 


B5 


B6 


B7 


B8 


B9 


B10 


B1 1 


Hex 


FF 


FF 


FF 


FF 


FF 


FF 


FF 


FF 


FF 


FF 


FF 




B241 


B242 


B243 


B244 


B245 


B246 


B247 


B248 


B249 


B250 


B251 




FF 


03 


91 


00 


F7 


FF 


FF 


FF 


FF 


FF 


FF 




B253 


B254 


B255 




















FF 


FF 


FF 



















B252 
FF 



Record 5: 



Record 5: 



Length of alpha identifier: 241 characters; 



Alpha identifier: 
Length of BCD number: 
TON and NPL 
Dialled number: 
CCI2: 
Ext3: 



empty; 
3; 

Telephony and International; 

"008"; 

'FF'; 

'FF'. 



Coding: 


B1 


B2 


B3 


B4 


B5 


B6 


B7 


B8 


B9 


B10 


B11 


Hex 


FF 


FF 


FF 


FF 


FF 


FF 


FF 


FF 


FF 


FF 


FF 




B241 


B242 


B243 


B244 


B245 


B246 


B247 


B248 


B249 


B250 


B251 




FF 


03 


91 


00 


F8 


FF 


FF 


FF 


FF 


FF 


FF 




B253 


B254 


B255 




















FF 


FF 


FF 



















B252 
FF 



EFext3 (Extension 3) 

Logically: 5 records, 4 records empty. Access to update EFexts shall be granted by usage of ADMl only. 
Record 1: 



Record type: 
Extension data: 
Identifier: 



'02' 
"012345"; 
'FF'. 



Record 1: 



Coding: 
Hex 



B1 
02 



B2 
03 



B3 
10 



B4 

32 



B5 
54 



B6 
FF 



B7 
FF 



B8 
FF 



B9 
FF 



BIO B11 
FF FF 



B12 B13 
FF FF 



9.2.4.2 Procedure 

a) The terminal is switched on and the USIM application shall be activated. 

b) The user shall use an MMI dependent procedure to set up a call to the dialling number associated with the alpha 
identifier 

"Hotline001122334455667788ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789abcdefghijklmnopqrstuvw 
xyz0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789abcdefghijklmnopqrstuvwxyz012345678 
9ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789abcdefghijklmnopqrstuvwxyz0123456789" in record 1 

of EFsDN. 

c) The user shall end the call. 

d) The user shall use an MMI dependent procedure to set up a call to the dialling number associated with the 
"Hotline003" in record 3 of EFsdn- 

e) The user shall end the call. 

f) The user shall use an MMI dependent procedure to select and to set up a call to the dialling number "+007" 
stored in record 4 of EFsdn- 
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g) The user shall end the call and switch the terminal off. 

9.2.5 Acceptance criteria 

1) After step a) the terminal shall have activated the USIM application and shall have read the status of the SDN 
service in EFust- 

2) After step b) the terminal shall have read record 1 of EFsdn and a call to "+22223333" shall have been 
established. 

3) After step c) the call shall have been terminated. 

4) After step d) the terminal shall have read record 3 of EFsdn and record 1 of EFexti and a call to 
"+01234567890123456789012345" shall have been estabhshed. 

5) After step e) the call shall have been terminated. 

6) After step f) the terminal shall have read record 4 of EFsdn and a call to "+007" shall have been established. 



10 CSG list handling 

10.1 CSG list handling for E-UTRA 

10.1.1 Automatic CSG selection in E-UTRA with CSG list on USIM, 
success 

1 0.1 .1 .1 Definition and applicability 

A Closed Subscriber Group identifies subscribers of an operator who are permitted to access one or more cells of the 
PLMN but which have restricted access (CSG cells). A CSG cell is part of the PLMN, broadcasting a CSG indication 
that is set to TRUE and a specific CSG identity. A CSG cell is accessible by the members of the closed subscriber group 
for that CSG identity. For a CSG cell, the UE shall check the broadcast CSG ID against the Allowed CSG list provided 
by NAS to check whether a CSG cell is suitable for the UE. 

1 0.1 .1 .2 Conformance requirement 

When a UE in idle mode detects the presence of a permissible CSG cell (a CSG cell whose CSG identity is in the UE"s 
white Hst), the UE shall select the CSG cell. 

The ME shall read the allowed CSG IDs from EFacsgl in order to perform HNB selection procedures. The lists in 
EFacsgl shall take precedence over the list stored in the ME non- volatile memory. 

If the MS supports CSG, it is provisioned with a list of allowed CSG identities and associated PLMN identities from the 
USIM if the Hst is available in the USIM. 

- TS 22.011 [6], subclause 8.2.2.1; 

- TS 31.102 [4], subclauses 4.4.6.2 and 5.8.1; 

- TS 23.122 [31], subclause 3.1 A. 



10.1.1.3 Test purpose 

To verify that the ME only selects a CSG cell if the CSG IDs of the cell is found in the allowed CSG IDs from EFacsgl 
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10.1.1.4 Method of test 
1 0.1 .1 .4.1 Initial conditions 

For this test an E-USS is required. 

The E-USS transmits on two cells, with the following network parameters: 

- TAI (MCC/MNC/TAC): 246/081/0001. 

- Access control: unrestricted. 

- csg-Indication: TRUE 

- csg-Identity: 05 



TAI (MCC/MNC/TAC): 246/08 1/0002. 

Access control: unrestricted. 

csg-Indication: TRUE 

csg-Identity: 04 



The default E-UTRAN UICC is used. 

The UICC is installed into the Terminal and the UE is set to automatic PLMN selection mode. 

10.1.1.4.2 Procedure 

a) The UE is powered on. 

b) After 2 minutes the E-USS stops all RF output for the first cell with TAI 246/081/0001 on the BCCH for a long 
enough period of time to cause a cell reselection procedure in the UE. The BCCH is changed to contain: 

- csg-Identity: 03 

The E-USS then resumes RF output on the BCCH. 

c) After receipt of an RRCConnectionRequest from the UE on the E-UTRAN-cell related to the BCCH transmitting 
TAI 246/081/0001, the E-USS sends RRCConnectionSetup to the UE, followed by 
RRCConnectionSetupComplete sent by the UE to the E-USS. 

d) During registration and after receipt of a AttachRequest from the UE, the E-USS initiates authentication, starts 
integrity by using the security procedure and sends AttachAccept with to the UE: 

TAI (MCC/MNC/TAC): 246/081/ 0001 

GUTI: "24608100010266436587" 

e) After receipt of the AttachComplete during registration from the UE, the E-USS sends RRCConnectionRelease to 
the UE. 

f) The UE is soft powered down. 

10.1.1.5 Acceptance criteria 

1) After steps a) the terminal shall not attempt an Attach procedure. 
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2.) After step b) the UE shall send an RRCConnectionRequest on the E-UTRAN-cell related to the BCCH 
transmitting TAI 246/081/0001 to the e-USS. 

3) During step c) the terminal shall send AttachRe quest to the E-USS. 

4) After step d) the terminal shall respond with AttachComplete during registration. 

5) After step e) the USIM shall contain the following values: 
EFepsloci (EPS Information) 

Logically: GUTI: 24608100010266436587 

Last visited registered TAL 246/081/0001 
EPS update status: updated 



Coding: 


B1 


B2 


B3 


B4 


B5 


B6 


B7 


B8 


B9 


BIO 


B11 


Hex 


OB 


F6 


42 


16 


80 


00 


01 


02 


66 


43 


65 




B12 


B13 


B14 


B15 


B16 


B17 


B18 










87 


42 


16 


80 


00 


01 


00 











1 0.1 .2 Automatic CSG selection in E-UTRA with CSG list on USIM, 
removal of CSG ID from the USIM 

1 0.1 .2.1 Definition and applicability 

A Closed Subscriber Group identifies subscribers of an operator who are permitted to access one or more cells of the 
PLMN but which have restricted access (CSG cells). A CSG cell is part of the PLMN, broadcasting a CSG indication 
that is set to TRUE and a specific CSG identity. A CSG cell is accessible by the members of the closed subscriber group 
for that CSG identity. For a CSG cell, the UE shall check the broadcast CSG ID against the Allowed CSG list provided 
by NAS to check whether a CSG cell is suitable for the UE. 

1 0.1 .2.2 Conformance requirement 

When a UE in idle mode detects the presence of a permissible CSG cell (a CSG cell whose CSG identity is in the UE"s 
white Hst), the UE shall select the CSG cell. 

The ME shall read the allowed CSG IDs from EFacsgl in order to perform HNB selection procedures. The lists in 
EFacsgl shall take precedence over the list stored in the ME non-volatile memory. 

If the MS supports CSG, it is provisioned with a list of allowed CSG identities and associated PLMN identities from the 
USIM if the Hst is available in the USIM. 

If the UE receives ATTACH REJECT with cause #25 (Not authorized for this CSG), the UE shall remove the CSG ID 
of the cell where the UE has sent the ATTACH REQUEST message from the Allowed CSG list. 

- TS 22.011 [6], subclause 8.2.2.1; 

- TS 31.102 [4], subclauses 4.4.6.2 and 5.8.1; 

- TS 23.122 [31], subclause 3.1 A. 

- TS 24.301 [26], subclause 5.5.1.2.5 

10.1.2.3 Test purpose 

To verify that the ME removes the CSG ID from the Allowed CSG list in EFacsgl in case this CSG ID belongs to the 
cell where the ME has sent the ATTACH REQUEST message which was rejected with cause #25 by the E-USS. 
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10.1.2.4 Method of test 
1 0.1 .2.4.1 Initial conditions 

For this test an E-USS is required. 

The E-USS transmits on two cells, with the following network parameters: 

- TAI (MCC/MNC/TAC): 246/081/0001. 

- Access control: unrestricted. 

- csg-Indication: TRUE 

- csg-Identity: 03 



TAI (MCC/MNC/TAC): 246/08 1/0002. 

Access control: unrestricted. 

csg-Indication: TRUE 

csg-Identity: 04 



The default E-UTRAN UICC is used. 

The UICC is installed into the Terminal and the UE is set to automatic PLMN selection mode. 

10.1.2.4.2 Procedure 

a) The UE is powered on. 

b) After receipt of an RRCConnectionRequest from the UE on the E-UTRAN-cell related to the BCCH transmitting 
TAI 246/081/0001, the E-USS sends RRCConnectionSetup to the UE, followed by 
RRCConnectionSetupComplete sent by the UE to the E-USS. 



c) During registration and after receipt of an AttachRequest from the UE, the E-USS sends AttachReject to the UE 
with cause #25 (Not authorized for this CSG), followed by RRCConnectionRelease. 



d) The UE is soft powered down. 



10.1.2.5 Acceptance criteria 

1.) After step a) the UE shall send an RRCConnectionRequest on the E-UTRAN-cell related to the BCCH 
transmitting TAI 246/081/0001 to the E-USS. 

2) During step b) the terminal shall ^tnd AttachRequest to the E-USS. 

3) After step c) the USIM shall contain the following values: 
EFepsloci (EPS Information) 

Logically: GUTI: not checked 

Last visited registered TAI: 246/081/0001 
EPS update status: ROAMING NOT ALLOWED 
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EFacsgl (Allowed CSG Lists) 



Logically: 
V' CSG list 



PLMN: 246 08 1 (MCC MNC) 

1'^ CSG list 1'^ CSG Type indication 

V CSG list 1'' CSG HNB Name indication 

CSG list 1^' CSG CSG ID: 



02 
02 

02 (27bit) 
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2nd CSG list 



PLMN: 

2"^ CSG list 
2"^ CSG list 
2^^ CSG list 



244 081 (MCC MNC) 

1'' CSG Type indication 08 

1^' CSG HNB Name indication 08 

V CSG CSG ID: 08 (27bit) 
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Note: the 1st and 2nd CSG list may be stored together or separately in any record in arbitrary order. 



1 0.1 .3 Manual CSG selection in E-UTRA with CSG list on USIM, success 

1 0.1 .3.1 Definition and applicability 

A Closed Subscriber Group identifies subscribers of an operator who are permitted to access one or more cells of the 
PLMN but which have restricted access (CSG cells). A CSG cell is part of the PLMN, broadcasting a CSG indication 
that is set to TRUE and a specific CSG identity. A CSG cell is accessible by the members of the closed subscriber group 
for that CSG identity. For a CSG cell, the UE shall check the broadcast CSG ID against the Allowed CSG list provided 
by NAS to check whether a CSG cell is suitable for the UE. 

A UE supporting CSG selection selects CSG cell either automatically based on the list of allowed CSG identities or 
manually based on user selection of CSG on indication of list of available CSGs. 

1 0.1 .3.2 Conformance requirement 

The ME shall read the allowed CSG IDs from EFacsgl in order to perform HNB selection procedures. The lists in 
EFacsgl shall take precedence over the list stored in the ME non-volatile memory. 

In manual CSG selection mode, the ME indicates to the user the list of available CSGs in the currently selected PLMN. 
The list of CSGs presented to the user is not restricted by the allowed CSG list.. 

If the MS supports CSG, it is provisioned with a list of allowed CSG identities and associated PLMN identities from the 
USIM if the hst is available in the USIM. 

If the UE supporting CSG selection has attempted manual CSG selection, the UE, when receiving the TRACKING 
AREA UPDATE ACCEPT message, shall check if the CSG ID of the cell where the UE has sent the TRACKING 
AREA UPDATE REQUEST message is contained in the Allowed CSG Hst. If not, the UE shall add that CSD ID to the 
Allowed CSG hst. 

- TS 31.102 [4], subclauses 4.4.6.2 and 5.8.1; 

- TS 23.122 [31], subclause 3.1 A. 

- TS 24.301 [26], subclause 5.5.3.2.4 
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10.1.3.3 Test purpose 

To verify that the ME adds the CSG ID to the Allowed CSG Hst in EFacsgl in case this CSG ID belongs to the cell 
where the ME has sent the TRACKING AREA UPDATE REQUEST message which was accepted by the E-USS. 

10.1.3.4 Method of test 

1 0.1 .3.4.1 Initial conditions 

For this test an E-USS is required. 

The E-USS transmits on two cells, with the following network parameters: 

- TAI (MCC/MNC/TAC): 246/081/0001. 

- Access control: unrestricted. 
csg-Indication: FALSE 

- csg-Identity: not present 



TAI (MCC/MNC/TAC): 246/08 1/0002. 

Access control: unrestricted. 

csg-Indication: TRUE 

csg-Identity: 04 



The default E-UTRAN UICC is used. 

The UICC is installed into the Terminal and the UE is set to automatic PLMN selection mode. 

10.1.3.4.2 Procedure 

a) The UE is powered on. 

b) After receipt of an RRCConnectionRequest from the UE on the E-UTRAN-cell related to the BCCH transmitting 
TAI 246/081/0001, the E-USS sends RRCConnectionSetup to the UE, followed by 
RRCConnectionSetupComplete sent by the UE to the E-USS. 

c) During registration and after receipt of an AttachRequest from the UE, the E-USS initiates authentication, starts 
integrity by using the security procedure and sends AttachAccept with to the UE: 

TAI (MCC/MNC/TAC):246/081/ 0001 

GUTI: "24608100010266345678" 



d) After receipt of the AttachComplete during registration from the UE, the E-USS sends RRCConnectionRelease 
to the UE. 



e) The MMI of the UE is used to perform manual CSG selection. The UE shall indicate the availability of a cell 
with csg-Identity 04 for PLMN 246/081. The user shall select this cell by using the MMI. 

f) After receipt of an RRCConnectionRequest from the UE on the E-UTRAN-cell related to the BCCH transmitting 
TAI 246/081/0002, the E-USS sends RRCConnectionSetup to the UE, followed by 
RRCConnectionSetupComplete sent by the UE to the E-USS. 
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g) During registration and after receipt of a TrackingAreaUpdateRequest from the UE, the E-USS initiates 
authentication, starts integrity by using the security procedure and sends TrackingAreaUpdateAccept with to the 
UE: 

TAI (MCC/MNC/TAC):246/081/ 0002 

GUTI: "24608100010266436599" 

h) After receipt of the TrackingAreaUpdatComplete during registration from the UE, the E-USS sends 
RRCConnectionRelease to the UE. 

i) The UE is soft powered down. 

10.1.3.5 Acceptance criteria 

1.) After step b) the UE shall send an RRCConnectionRequest on the E-UTRAN-cell related to the BCCH 
transmitting TAI 246/081/0001 to the e-USS. 

3) During step b) the terminal shall send AttachRequest to the E-USS. 

4) After step c) the terminal shall respond with AttachComplete during registration. 

5) During step e) the UE shall provide during the manual CSG selection the information for a cell with csg-Identity 
04 for PLMN 246/081 to the user. 

6.) After step e) the UE shall send an RRCConnectionRequest on the E-UTRAN-cell related to the BCCH 
transmitting TAI 246/081/0002 to the e-USS. 

7) During step f) the terminal shall send TrackingAreaUpdateRequest to the E-USS. 

8) After step g) the terminal shall respond with TrackingAreaUpdatComplete during registration. 

9) After step i) the USIM shall contain the following values: 
EFepsloci (EPS Information) 

Logically: GUTI: 24608 100010266436599 

Last visited registered TAI: 246/081/0002 
EPS update status: updated 
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EFacsgl (Allowed CSG Lists) 

Logically: 
V CSG list 



PLMN: 246 08 1 (MCC MNC) 

1'' CSG list 1'' CSG Type indication 02 

V CSG Hst 1^' CSG HNB Name indication 02 

V CSG Hst V CSG CSG ID: 02 (27bit) 
CSG list 2^^ CSG Type indication 03 

CSG Hst 2"^ CSG HNB Name indication 03 

V CSG Hst 2"^ CSG CSG ID: 03 (27bit) 

V CSG Hst 3'^ CSG Type indication 'FF' 
1 CSG Hst 3'^ CSG HNB Name indication 'FF' 

CSG Hst 3'^ CSG CSG ID: 04 (27bit) 
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Coding: 
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2nd CSG list 



PLMN: 
2^^ CSG list 
2"^ CSG list 
2"^ CSG list 



244 081 (MCC MNC) 

1'^ CSG Type indication 08 

1 CSG HNB Name indication 08 

1^' CSG CSG ID: 08 (27bit) 
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Note: The 1st and 2nd CSG list may be stored together or separately in any record in arbitrary order. 



10.1 .4 Manual CSG selection in E-UTRA with CSG list on USIM, rejected 

1 0.1 .4.1 Definition and applicability 

A Closed Subscriber Group identifies subscribers of an operator who are permitted to access one or more cells of the 
PLMN but which have restricted access (CSG cells). A CSG cell is part of the PLMN, broadcasting a CSG indication 
that is set to TRUE and a specific CSG identity. A CSG cell is accessible by the members of the closed subscriber group 
for that CSG identity. For a CSG cell, the UE shall check the broadcast CSG ID against the Allowed CSG list provided 
by NAS to check whether a CSG cell is suitable for the UE. 

A UE supporting CSG selection selects CSG cell either automatically based on the list of allowed CSG identities or 
manually based on user selection of CSG on indication of list of available CSGs. 

1 0.1 .4.2 Conformance requirement 

The ME shall read the allowed CSG IDs from EFacsgl in order to perform HNB selection procedures. The lists in 
EFacsgl shall take precedence over the list stored in the ME non-volatile memory. 

In manual CSG selection mode, the ME indicates to the user the list of available CSGs in the currently selected PLMN. 
The list of CSGs presented to the user is not restricted by the allowed CSG list. 

If the MS supports CSG, it is provisioned with a list of allowed CSG identities and associated PLMN identities from the 
USIM if the Hst is available in the USIM. 

If the UE supporting CSG selection has attempted manual CSG selection, the UE, when receiving the TRACKING 
AREA UPDATE REJECT message with cause #25 (Not authorized for this CSG), shall remove the CSG ID of the cell 
where the UE has sent the TRACKING AREA UPDATE REQUEST message if the CSG ID is contained in the 
Allowed CSG Hst. 

- TS 31.102 [4], subclauses 4.4.6.2 and 5.8.1; 

- TS 23.122 [31], subclause 3.1A. 

- TS 24.301 [26], subclause 5.5.3.2.5 



10.1.4.3 Test purpose 

To verify that the ME does not add the CSG ID to the Allowed CSG Hst in EFacsgl in case this CSG ID belongs to the 
ceU where the ME has sent the TRACKING AREA UPDATE REQUEST message which was rejected by the E-USS. 
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10.1.4.4 Method of test 
1 0.1 .4.4.1 Initial conditions 

For this test an E-USS is required. 

The E-USS transmits on two cells, with the following network parameters: 

- TAI (MCC/MNC/TAC): 246/081/0001. 

- Access control: unrestricted. 

- csg-Indication: FALSE 

- csg-Identity: not present 



TAI (MCC/MNC/TAC): 246/08 1/0002. 

Access control: unrestricted. 

csg-Indication: TRUE 

csg-Identity: 04 



The default E-UTRAN UICC is used. 

The UICC is installed into the Terminal and the UE is set to automatic PLMN selection mode. 

10.1.4.4.2 Procedure 

a) The UE is powered on. 

b) After receipt of an RRCConnectionRequest from the UE on the E-UTRAN-cell related to the BCCH transmitting 
TAI 246/081/0001, the E-USS sends RRCConnectionSetup to the UE, followed by 
RRCConnectionSetupComplete sent by the UE to the E-USS. 

c) During registration and after receipt of a AttachRequest from the UE, the E-USS initiates authentication, starts 
integrity by using the security procedure and sends AttachAccept with to the UE: 

TAI (MCC/MNC/TAC): 246/081/ 0001 

GUTI: "24608100010266345678" 

d) After receipt of the AttachComplete during registration from the UE, the E-USS sends RRCConnectionRelease, 
to the UE. 



e) The MMI of the UE is used to perform manual CSG selection. The UE shall indicate the availability of a cell 
with csg-Identity 04 for PLMN 246/081. The user shall select this cell by using the MMI. 

f) After receipt of an RRCConnectionRequest from the UE on the E-UTRAN-cell related to the BCCH transmitting 
TAI 246/081/0002, the E-USS sends RRCConnectionSetup to the UE, followed by 
RRCConnectionSetupComplete sent by the UE to the E-USS. 



g) During registration and after receipt of an TrackingAreaUpdateRequest from the UE, the E-USS sends 
TrackingAreaUpdateReject to the UE with cause #25 (Not authorized for this CSG), followed by 
RRCConnectionRelease to the UE. 

h) The UE is soft powered down. 



10.1 .4.5 Acceptance criteria 
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1.) After step b) the UE shall send an RRCConnectionRequest on the E-UTRAN-cell related to the BCCH 
transmitting TAI 246/081/0001 to the e-USS. 

3) During step b) the terminal shall send AttachRequest to the E-USS. 

4) After step c) the terminal shall respond with AttachComplete during registration. 

5. ) During step e) the UE shall provide during the manual CSG selection the information for a cell with csg-Identity 

04 for PLMN 246/081 to the user. 

6. ) After step e) the UE shall send a RRCConnectionRequest on the E-UTRAN-cell related to the BCCH 

transmitting TAI 246/081/0002 to the e-USS. 

7) During step f) the terminal shall send TrackingAreaUpdateRequest to the E-USS. 

8) After step h) the USIM shall contain the following values: 
EFepsloci (EPS Information) 

Logically: GUTI: not checked 

Last visited registered TAL 246/081/0001 
EPS update status: ROAMING NOT ALLOWED 
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EFacsgl (Allowed CSG Lists) 

Content not changed, shall be the same as defined in clause 4.4.5. 



1 0.1 .5 CSG selection in E-UTRA with no CSG list on USIM, no IMSI 
change 

1 0.1 .5.1 Definition and applicability 

A Closed Subscriber Group identifies subscribers of an operator who are permitted to access one or more cells of the 
PLMN but which have restricted access (CSG cells). A CSG cell is part of the PLMN, broadcasting a CSG indication 
that is set to TRUE and a specific CSG identity. A CSG cell is accessible by the members of the closed subscriber group 
for that CSG identity. For a CSG cell, the UE shall check the broadcast CSG ID against the Allowed CSG list provided 
by NAS to check whether a CSG cell is suitable for the UE. 

A UE supporting CSG selection selects CSG cell either automatically based on the list of allowed CSG identities or 
manually based on user selection of CSG on indication of list of available CSGs. 

1 0.1 .5.2 Conformance requirement 

In manual CSG selection mode, the ME indicates to the user the list of available CSGs in the currently selected PLMN. 
The list of CSGs presented to the user is not restricted by the allowed CSG list.. 

If the MS supports CSG, it is provisioned with a list of allowed CSG identities and associated PLMN identities from the 
USIM if the Hst is available in the USIM. 

If the UE supporting CSG selection has attempted manual CSG selection, the UE, when receiving the TRACKING 
AREA UPDATE ACCEPT message, shall check if the CSG ID of the cell where the UE has sent the TRACKING 
AREA UPDATE REQUEST message is contained in the Allowed CSG Hst. If not, the UE shall add that CSD ID to the 
Allowed CSG list. 
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If the corresponding file is not present on the USIM, these EMM parameters except allowed CSG list are stored in a 
non-volatile memory in the ME together with the IMSI from the USIM. The allowed CSG list is stored in a non-volatile 
memory in the ME if the UE supports CSG selection. These EMM parameters can only be used if the IMSI from the 
USIM matches the IMSI stored in the non- volatile memory; else the UE shall delete the EMM parameters. 

- TS 31.102 [4], subclauses 4.4.6.2 and 5.8.1; 

- TS 23.122 [31], subclause 3.1 A. 

- TS 24.301 [26], subclause 5.5.3.2.4 and Annex C. 



10.1.5.3 Test purpose 

To verify that the ME adds the CSG ID to the Allowed CSG list in a non- volatile memory in the ME together with the 
IMSI from the USIM in case this CSG ID belongs to the cell where the ME has sent the TRACKING AREA UPDATE 
REQUEST message which was accepted by the E-USS as the corresponding file is not present on the simulated USIM. 

To verify that the ME still has this CSG ID stored in the Allowed CSG list available together with the IMSI after 
powered down and up in case the IMSI of the USIM has not changed. 

To verify that the ME removes the CSG ID from the Allowed CSG list inside the terminal in case this CSG ID belongs 
to the cell where the ME has sent the ATTACH REQUEST message which was rejected with cause #25 by the E-USS. 



10.1.5.4 Method of test 
1 0.1 .5.4.1 Initial conditions 

For this test an E-USS is required. 

The E-USS transmits on two cells, with the following network parameters: 

- TAI (MCC/MNC/TAC): 246/081/0001. 

- Access control: unrestricted. 

- csg-Indication: FALSE 

- csg-Identity: not present 



TAI (MCC/MNC/TAC): 246/08 1/0002. 

Access control: unrestricted. 

csg-Indication: TRUE 

csg-Identity: 04 



The default UICC (without the service "Allowed CSG Lists and corresponding indications") is installed into the 
Terminal. 

The ME shall not have csg-ID = 04 in the allowed CSG list stored in a non- volatile memory in the ME and the ME is 
set to automatic PLMN selection mode. 

10.1.5.4.2 Procedure 

a) The UE is powered on. 
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b) After receipt of an RRCConnectionRequest from the UE on the E-UTRAN-cell related to the BCCH transmitting 
TAI 246/081/0001, the E-USS sends RRCConnectionSetup to the UE, followed by 
RRCConnectionSetupComplete sent by the UE to the E-USS. 

c) During registration and after receipt of m AttachRequest from the UE, the E-USS initiates authentication, starts 
integrity by using the security procedure and sends AttachAccept with the following parameters to the UE: 

TAI (MCC/MNC/TAC):246/081/ 0001 

GUTI: "24608100010266345678" 

d) After receipt of the AttachComplete during registration from the UE, the E-USS sends RRCConnectionRelease to 
the UE. 

e) The MMI of the UE is used to perform manual CSG selection. The UE shall indicate the availability of a cell 
with csg-Identity 04 for PLMN 246/081. The user shall select this cell by using the MMI. 

f) After receipt of an RRCConnectionRequest from the UE on the E-UTRAN-cell related to the BCCH transmitting 
TAI 246/081/0002, the E-USS sends RRCConnectionSetup to the UE, followed by 
RRCConnectionSetupComplete sent by the UE to the E-USS. 

g) During registration and after receipt of a TrackingAreaUpdateRequest from the UE, the E-USS initiates 
authentication, starts integrity by using the security procedure and sends TrackingAreaUpdateAccept with the 
following parameters to the UE: 

TAI (MCC/MNC/TAC):246/081/TACs: 0002 

GUTI: "24608100010266345699" 

h) After receipt of the TrackingAreaUpdateComplete during registration from the UE, the E-USS sends 
RRCConnectionRelease to the UE. 

i) The UE is switched off and performs the Detach procedure, 
j) The default UICC remains in use. 

k) The E-USS shall change the BCCH for the cell transmitting TAI 246/081/0001 to the following network 
parameters: 

- csg-Indication: TRUE 

- csg-Identity: 06 
1) The UE is powered on. 

m) After receipt of an RRCConnectionRequest from the UE on the E-UTRAN-cell related to the BCCH transmitting 
TAI 246/081/0002, the E-USS sends RRCConnectionSetup to the UE, followed by 
RRCConnectionSetupComplete sent by the UE to the E-USS. 

n) During registration and after receipt of MiAttachRequest from the UE, the E-USS sends AttachReject to the UE 
with cause #25 (Not authorized for this CSG), followed by RRCConnectionRelease. 

o) The UE is soft powered down. 

p) The default UICC remains in use. 

q) The UE is powered on. 

r) After 2 minutes the UE is soft powered down. 

10.1.5.5 Acceptance criteria 

1.) After step b) the UE shall send an RRCConnectionRequest on the E-UTRAN-cell related to the BCCH 
transmitting TAI 246/081/0001 to the e-USS. 

3) During step b) the terminal shall send AttachRequest to the E-USS. 
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4) After step c) the terminal shall respond with AttachComplete during registration. 

5) During step e) the UE shall provide during the manual CSG selection the information for a cell with csg-Identity 
04 for PLMN 246/081 to the user. 

6.) After step e) the UE shall send an RRCConnectionRequest on the E-UTRAN-cell related to the BCCH 
transmitting TAI 246/081/0002 to the e-USS. 

7) During step f) the terminal shall send TrackingAreaUpdateRequest to the E-USS. 

8) After step g) the terminal shall respond with TrackingAreaUpdateComplete during registration. 

9.) After step 1) the UE shall send an RRCConnectionRequest on the E-UTRAN-cell related to the BCCH 
transmitting TAI 246/081/0002 to the e-USS. 

10) During step n) the terminal shall send AttachRequest to the E-USS. 

1 1) After step q) the terminal shall not try to register to the E-USS. 



1 0.1 .6 CSG selection in E-UTRA with no CSG list on USIM, with IMS! 
change 

1 0.1 .6.1 Definition and applicability 

A Closed Subscriber Group identifies subscribers of an operator who are permitted to access one or more cells of the 
PLMN but which have restricted access (CSG cells). A CSG cell is part of the PLMN, broadcasting a CSG indication 
that is set to TRUE and a specific CSG identity. A CSG cell is accessible by the members of the closed subscriber group 
for that CSG identity. For a CSG cell, the UE shall check the broadcast CSG ID against the Allowed CSG list provided 
by NAS to check whether a CSG cell is suitable for the UE. 

A UE supporting CSG selection selects CSG cell either automatically based on the list of allowed CSG identities or 
manually based on user selection of CSG on indication of list of available CSGs. 

1 0.1 .6.2 Conformance requirement 

In manual CSG selection mode, the ME indicates to the user the list of available CSGs in the currently selected PLMN. 
The list of CSGs presented to the user is not restricted by the allowed CSG list.. 

If the MS supports CSG, it is provisioned with a list of allowed CSG identities and associated PLMN identities from the 
USIM if the hst is available in the USIM. 

If the UE supporting CSG selection has attempted manual CSG selection, the UE, when receiving the TRACKING 
AREA UPDATE ACCEPT message, shall check if the CSG ID of the cell where the UE has sent the TRACKING 
AREA UPDATE REQUEST message is contained in the Allowed CSG hst. If not, the UE shall add that CSD ID to the 
Allowed CSG hst. 

If the corresponding file is not present on the USIM, these EMM parameters except allowed CSG list are stored in a 
non-volatile memory in the ME together with the IMSI from the USIM. The allowed CSG list is stored in a non- volatile 
memory in the ME if the UE supports CSG selection. These EMM parameters can only be used if the IMSI from the 
USIM matches the IMSI stored in the non-volatile memory; else the UE shall delete the EMM parameters. 

- TS 31.102 [4], subclauses 4.4.6.2 and 5.8.1; 

- TS 23.122 [31], subclause 3.1A. 

- TS 24.301 [26], subclause 5.5.3.2.4 and Annex C. 
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10.1.6.3 Test purpose 

To verify that the ME adds the CSG ID to the Allowed CSG list in a non- volatile memory in the ME together with the 
IMSI from the USIM in case this CSG ID belongs to the cell where the ME has sent the TRACKING AREA UPDATE 
REQUEST message which was accepted by the E-USS as the corresponding file is not present on the simulated USIM. 

To verify that the ME removes this CSG ID stored in the Allowed CSG list available together with the IMSI after 
powered down and up in case the IMSI of the USIM has changed. 

10.1.6.4 Method of test 

1 0.1 .6.4.1 Initial conditions 

For this test an E-USS is required. 

The E-USS transmits on two cells, with the following network parameters: 

- TAI (MCC/MNC/TAC): 246/081/0001. 

- Access control: unrestricted. 

- csg-Indication: FALSE 

- csg-Identity: not present 



TAI (MCC/MNC/TAC): 246/08 1/0002. 

Access control: unrestricted. 

csg-Indication: TRUE 

csg-Identity: 04 



The default UICC (without the service "Allowed CSG Lists and corresponding indications") is installed into the 
Terminal. 

The ME shall not have csg-ID = 04 in the allowed CSG list stored in a non- volatile memory in the ME and the ME is 
set to automatic PLMN selection mode. 



10.1.6.4.2 Procedure 

a) The UE is powered on. 

b) After receipt of an RRCConnectionRequest from the UE on the E-UTRAN-cell related to the BCCH transmitting 
TAI 246/081/0001, the E-USS sends RRCConnectionSetup to the UE, followed by 
RRCConnectionSetupComplete sent by the UE to the E-USS. 

c) During registration and after receipt of an AttachRequest from the UE, the E-USS initiates authentication, starts 
integrity by using the security procedure and sends AttachAccept with to the following parameters the UE: 

TAI (MCC/MNC/TAC):246/081/ 0001 

GUTI: "24608100010266345678" 

d) After receipt of the AttachComplete during registration from the UE, the E-USS sends RRCConnectionRelease to 
the UE. 

e) The MMI of the UE is used to perform manual CSG selection. The UE shall indicate the availability of a cell 
with csg-Identity 04 for PLMN 246/081. The user shall select this cell by using the MMI. 
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f) After receipt of an RRCConnectionRequest from the UE on the E-UTRAN-cell related to the BCCH transmitting 
TAI 246/081/0002, the E-USS sends RRCConnectionSetup to the UE, followed by 
RRCConnectionSetupComplete sent by the UE to the E-USS. 

g) During registration and after receipt of a TrackingAreaUpdateRequest from the UE, the E-USS initiates 
authentication, starts integrity by using the security procedure and sends TrackingAreaUpdateAccept with the 
following parameters to the UE: 

TAI (MCC/MNC/TAC):246/081/ 0002 

GUTI: "24608100010266345699" 

h) After receipt of the TrackingAreaUpdateComplete during registration from the UE, the E-USS sends 
RRCConnectionRelease to the UE. 

i) The UE is switched off and performs the Detach procedure, 
j) A new UICC with the following configuration is activated: 

The default UICC with the following exception: The IMSI is set to "246081222233333". 

k) The E-USS shall change the BCCH for the cell transmitting TAI 246/081/0001 to the following network 
parameters: 

- csg-Indication: TRUE 

- csg-Identity: 06 
1) The UE is powered on. 

m) After 2 minutes the UE is soft powered down. 

10.1 .6.5 Acceptance criteria 

1.) After step b) the UE shall send an RRCConnectionRequest on the E-UTRAN-cell related to the BCCH 
transmitting TAI 246/081/0001 to the e-USS. 

3) During step b) the terminal shall send AttachRequest to the E-USS. 

4) After step c) the terminal shall respond with AttachComplete during registration. 

5) During step e) the UE shall provide during the manual CSG selection the information for a cell with csg-Identity 
04 for PLMN 246/081 to the user. 

6.) After step e) the UE shall send an RRCConnectionRequest on the E-UTRAN-cell related to the BCCH 
transmitting TAI 246/081/0002 to the e-USS. 

7) During step f) the terminal shall send TrackingAreaUpdateRequest to the E-USS. 

8) After step g) the terminal shall respond with TrackingAreaUpdateComplete during registration. 

9) After step 1) the terminal shall not try to register to the E-USS. 
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1 1 NAS security context parameter handling 

11.1 NAS security context parameter handling when service 
"EMM Information" is available 

11.1.1 Definition and applicability 

The security parameters for authentication, integrity protection and ciphering are tied together in an EPS security 
context and identified by a key set identifier for E-UTRAN (eKSI). The relationship between the security parameters is 
defined in 3GPP TS 33.401 [27]. 

The EPS security context parameters shall be stored on the USIM if the corresponding file is present. If the 
corresponding file is not present on the USIM, these EMM parameters except allowed CSG list are stored in a non- 
volatile memory in the ME together with the IMSI from the USIM. 

The EFepsnsc contains the EPS NAS Security context as defined in TS 33.401 [27]. This file shall contain only one 
record and shall be updated only when the requirements defined in TS 33.401 [27] are met. 

1 1 .1 .2 Conformance requirement 

EPS AKA is the authentication and key agreement procedure that shall be used over E-UTRAN. 

Before security can be activated, the MME and the UE need to establish an EPS security context. Usually, the EPS 
security context is created as the result of an authentication procedure between MME and UE 
The EPS security context parameters shall be stored on the USIM if the corresponding file is present, and shall be 
updated only when the requirements defined in TS 33.401 [27] are met. 

If the corresponding file is not present on the USIM, these EMM parameters except allowed CSG list are stored in a 
non- volatile memory in the ME together with the IMSI from the USIM. 

- TS 24.301 [6], subclause 4.2.2.1 and Annex C; 

- TS 31.102 [4], subclause 4.2.92; 

- TS 33.401 [27], subclause 6.1.1. 

11.1.3 Test purpose 

To verify that the ME generates the EPS security context identified by a key set identifier for E-UTRAN (eKSI) and 
stores all inside EFepsnsc if this EE is available and when the requirements defined in TS 33.401 [27] are met. 

11.1.4 Method of test 
11.1.4.1 Initial conditions 

For this test an E-USS is required. 

The E-USS transmits on one cell, with the following network parameters: 

- TAI (MCC/MNC/TAC):246/081/0001. 

- Access control: unrestricted. 

The default E-UTRAN UICC is used. 
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11.1.4.2 Procedure 

a) The UE is switched on. 

b) After receipt of an RRCConnectionRe quest from the UE the E-USS sends RRCConnectionSetup to the UE, 
followed by RRCConnectionSetupComplete sent by the UE to the E-USS. 

c) During registration and after receipt of an AttachRequest (included in the RRCConnectionSetupComplete) from 
the UE, the E-USS initiates the EPS authentication and AKA procedure. The E-USS uses 

eKSI: '00' 

d) Afterwards the E-USS transmits a (NAS) SecurityModeCommand message to activate NAS security, and after 

receiving (NAS) SecurityModeComplete from the UE, the E-USS sends AttachAccept to the UE with: 

TAI (MCC/MNC/TAC): 246/081/ 0001 

GUTI: "24608100010266345678" 

e) After receipt of the AttachComplete during registration from the UE, the E-USS sends RRCConnectionRelease, 
to the UE 

f) The UE or the UE's radio interface is switched off to perform the DETACH procedure. 



11.1.5 Acceptance criteria 

1) After step a) the UE shall read EFust and EFepsnsc- 

2) During step b) the UE shall indicate in the AttachRequest that no key is available 

3) During step c) the UE shall send the Authentic ationResponse message. 

4) During step d) the UE shall send the (NAS) SecurityModeComplete message 

5) EFepsnsc shall not be updated during steps b) to e). 

6) After step f) the UE shall send DETACH REQUEST to the E-USS. 

7) After step f) EFepsnsc shall contain: 

EFepsnsc (EPS NAS Security Context) 

Logically: Key Set Identifier KSIasme: '00' 

ASME Key (KSIasme) • 32 byte key, value not checked 

Uplink NAS count: any value 

Downlink NAS count: any value 

Identifiers of selected NAS any value 

integrity and encryption 

algorithm 

Coding: B1 B2 B3 B4 B5 B6 B7 B8 ... ... ... Bxx 

Hex AO XX 80 01 00 81 xx xx ... ... ... xx 
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1 1 .2 NAS security context parameter handling when service 
"EMM Information" is not available, no IMSI change 

1 1 .2.1 Definition and applicability 

The security parameters for authentication, integrity protection and ciphering are tied together in an EPS security 
context and identified by a key set identifier for E-UTRAN (eKSI). The relationship between the security parameters is 
defined in 3GPP TS 33.401 [27]. 

The EPS security context parameters shall be stored on the USIM if the corresponding file is present. If the 
corresponding file is not present on the USIM, these EMM parameters except allowed CSG list are stored in a non- 
volatile memory in the ME together with the IMSI from the USIM. 

The EFepsnsc contains the EPS NAS Security context as defined in TS 33.401 [27]. This file shall contain only one 
record. 



1 1 .2.2 Conformance requirement 

EPS AKA is the authentication and key agreement procedure that shall be used over E-UTRAN. 

Before security can be activated, the MME and the UE need to establish an EPS security context. Usually, the EPS 

security context is created as the result of an authentication procedure between MME and UE 

The EPS security context parameters shall be stored on the USIM if the corresponding file is present. 

If the corresponding file is not present on the USIM, these EMM parameters except allowed CSG list are stored in a 

non-volatile memory in the ME together with the IMSI from the USIM. 

These EMM parameters can only be used if the IMSI from the USIM matches the IMSI stored in the non-volatile 
memory; else the UE shall delete the EMM parameters. 

- TS 24.301 [6], subclause 4.2.2.1 and Annex C; 

- TS 31.102 [4], subclause 4.2.92; 

- TS 33.401 [27], subclause 6.1.1. 

11.2.3 Test purpose 

To verify that the ME generates the EPS security context identified by a key set identifier for E-UTRAN (eKSI) and 
stores all inside a non- volatile memory in the ME as EMM information is not available on the USIM. During the test 
the IMSI on the USIM remains unchanged. 

1 1 .2.4 Method of test 

1 1 .2.4.1 Initial conditions 

For this test an E-USS is required. 

The E-USS transmits on one cell, with the following network parameters: 

- TAI (MCC/MNC/TAC):246/081/0001. 

- Access control: unrestricted. 



The default UICC (without the service "EMM Information") is installed into the Terminal and the UE is powered on. 
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1 1 .2.4.2 Procedure 

a) The UE is switched on. 

b) After receipt of an RRCConnectionRequest from the UE the E-USS sends RRC Connections etup to the UE, 
followed by RRC Connections etup Complete sent by the UE to the E-USS. 

c) During registration and after receipt of an AttachRequest (included in the RRCConnectionSetupComplete) from 
the UE, the E-USS initiates the EPS authentication and AKA procedure. The E-USS uses 

eKSI: 00 

d) Afterwards the E-USS transmits a (NAS) SecurityModeCommand message to activate NAS security, and after 

receiving (NAS) SecurityModeComplete from the UE, the E-USS sends AttachAccept to the UE with: 

TAI (MCC/MNC/TAC):246/081/ 0001 

GUTI: "24608 1 000 1 0266345678 " 

e) After receipt of the AttachComplete during registration from the UE, the E-USS sends RRCConnectionRelease, 
to the UE 

f) The UE is switched off and performs the Detach procedure. 

g) The default UICC remains in use. 

h) The Terminal is switched on. 

i) After receipt of an RRCConnectionRequest from the UE the E-USS sends RRC Connections etup to the UE, 
followed by RRCConnectionSetupComplete sent by the UE to the E-USS. 

j) During registration and after receipt of an AttachRequest (included in the RRCConnectionSetupComplete) from 
the UE, E-USS transmits a (NAS) SecurityModeCommand message to activate NAS security using the last 
known Kasme? and after receiving (NAS) SecurityModeComplete from the UE, the E-USS sends AttachAccept to 
the UE with: 

TAI (MCC/MNC/TAC) Hst: 246/081/TACs: 0001, 0003, 0004 

GUTI: "24608100010266345619" 

k) After receipt of the AttachComplete during registration from the UE, the E-USS sends RRCConnectionRelease to 
the UE 

1 1 .2.5 Acceptance criteria 

1) After step a) the UE shall read EFust 

2) During step c) the UE shall send the AuthenticationResponse message. 

3) During step d) the UE shall send the (NAS) SecurityModeComplete message 

4) During step j) UE shall indicate in the AttachRequest eKSI as 00 

5) During step j) the UE shall send the (NAS) SecurityModeComplete message 

6) During step k) the UE shall send the AttachComplete message 
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1 1 .3 NAS security context parameter handling when service 
"EMM Information" is not available, IMSI changed 

1 1 .3.1 Definition and applicability 

The security parameters for authentication, integrity protection and ciphering are tied together in an EPS security 
context and identified by a key set identifier for E-UTRAN (eKSI). The relationship between the security parameters is 
defined in 3GPP TS 33.401 [27]. 

The EPS security context parameters shall be stored on the USIM if the corresponding file is present. If the 
corresponding file is not present on the USIM, these EMM parameters except allowed CSG list are stored in a non- 
volatile memory in the ME together with the IMSI from the USIM. 

The EFepsnsc contains the EPS NAS Security context as defined in TS 33.401 [27]. This file shall contain only one 
record. 

1 1 .3.2 Conformance requirement 

EPS AKA is the authentication and key agreement procedure that shall be used over E-UTRAN. 

Before security can be activated, the MME and the UE need to establish an EPS security context. Usually, the EPS 

security context is created as the result of an authentication procedure between MME and UE 

The EPS security context parameters shall be stored on the USIM if the corresponding file is present. 

If the corresponding file is not present on the USIM, these EMM parameters except allowed CSG list are stored in a 

non- volatile memory in the ME together with the IMSI from the USIM. 

These EMM parameters can only be used if the IMSI from the USIM matches the IMSI stored in the non- volatile 
memory; else the UE shall delete the EMM parameters. 

- TS 24.301 [6], subclause 4.2.2.1 and Annex C; 

- TS 31.102 [4], subclause 4.2.92; 

- TS 33.401 [27], subclause 6.1.1. 

1 1 .3.3 Test purpose 

1. ) To verify that the ME generates the EPS security context identified by a key set identifier for E-UTRAN (eKSI) and 
stores all inside a non- volatile memory in the ME as EMM information is not available on the USIM. 

2. ) To verify that UE deletes existing EMM parameters from the ME's non- volatile memory in case a different IMSI is 
activated. 

11.3.4 Method of test 

1 1 .3.4.1 Initial conditions 

For this test an E-USS is required. 

The E-USS transmits on one cell, with the following network parameters: 

- TAI (MCC/MNC/TAC):246/081/0001. 

- Access control: unrestricted. 



The default UICC (without the service "EMM Information") is installed into the Terminal and the UE is powered on. 
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1 1 .3.4.2 Procedure 

a) The UE is switched on. 

b) After receipt of an RRCConnectionRequest from the UE the E-USS sends RRC Connections etup to the UE, 
followed by RRC Connections etup Complete sent by the UE to the E-USS. 

c) During registration and after receipt of an AttachRequest (included in the RRCConnectionSetupComplete) from 
the UE, the E-USS initiates the EPS authentication and AKA procedure. The E-USS uses 

eKSI: 00 

d) Afterwards the E-USS transmits a (NAS) SecurityModeCommand message to activate NAS security, and after 

receiving (NAS) SecurityModeComplete from the UE, the E-USS sends AttachAccept to the UE with: 

TAI (MCC/MNC/TAC):246/081/ 0001 

GUTI: "24608 1 000 1 0266345678 " 

e) After receipt of the AttachComplete during registration from the UE, the E-USS sends RRCConnectionRelease, 
to the UE 

f) The UE is switched off and performs the Detach procedure. 

g) A new UICC with the following configuration is activated: 

The default UICC with the following exception: The IMSI is set to "246081222233333". 

h) The Terminal is switched on. 

i) After receipt of an RRCConnectionRequest from the UE the E-USS sends RRCConnectionSetup to the UE, 
followed by RRCConnectionSetupComplete sent by the UE to the E-USS. 

j) During registration and after receipt of an ATTACH REQUEST (included in the 

RRCConnectionSetupComplete) from the UE, E-USS transmits a (NAS) SecurityModeCommand message to 
activate NAS security using the last known Kasme • 

k) The UE responds with (NAS) SecurityModeReject. 

1) The E-USS sends RRCConnectionRelease to the UE 

1 1 .3.5 Acceptance criteria 

1) After step a) the UE shall read EFust 

2) During step c) the UE shall send the Authentic ationResponse message. 

3) During step d) the UE shall send the (NAS) SecurityModeComplete message 

4) During step j) UE shall indicate in the AttachRequest that no key is available 

5) After step j) the UE shall send the (NAS) SecurityModeReject message 
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